@agent-native/core 0.100.1 → 0.101.2

package/corpus/core/src/review/store.ts

@@ -1,4 +1,4 @@
-import { getDbExec, isPostgres } from "../db/client.js";
+import { getDbExec, isPostgres, type DbExec } from "../db/client.js";
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import type { Visibility } from "../sharing/schema.js";
 import type {
@@ -43,9 +43,25 @@ export interface QueryReviewCommentsInput {
   includeResolved?: boolean;
   includeDeleted?: boolean;
   targetId?: string | null;
+  rootOnly?: boolean;
+  resolutionTargets?: readonly (ReviewResolutionTarget | null)[];
+  unconsumedOnly?: boolean;
   limit?: number;
 }
 
+export interface GetReviewThreadSummaryInput {
+  resourceType: string;
+  resourceId: string;
+  scope: ReviewScope;
+  bypassScope?: boolean;
+  targetId?: string | null;
+}
+
+export interface ReviewThreadSummary {
+  openCount: number;
+  agentQueueCount: number;
+}
+
 export interface UpsertReviewStatusInput {
   resourceType: string;
   resourceId: string;
@@ -112,6 +128,15 @@ export async function ensureReviewTables(): Promise<void> {
            ON agent_review_comments (owner_email, created_at)`,
         `CREATE INDEX IF NOT EXISTS idx_agent_review_comments_org
            ON agent_review_comments (org_id, created_at)`,
+        `CREATE INDEX IF NOT EXISTS idx_agent_review_comments_queue
+           ON agent_review_comments (
+             resource_type,
+             resource_id,
+             parent_comment_id,
+             resolution_target,
+             consumed_at,
+             created_at
+           )`,
         `CREATE INDEX IF NOT EXISTS idx_agent_review_statuses_resource
            ON agent_review_statuses (resource_type, resource_id)`,
       ];
@@ -126,9 +151,10 @@ export async function ensureReviewTables(): Promise<void> {
         await ensureIndexExists("idx_agent_review_comments_thread", indexes[1]);
         await ensureIndexExists("idx_agent_review_comments_owner", indexes[2]);
         await ensureIndexExists("idx_agent_review_comments_org", indexes[3]);
+        await ensureIndexExists("idx_agent_review_comments_queue", indexes[4]);
         await ensureIndexExists(
           "idx_agent_review_statuses_resource",
-          indexes[4],
+          indexes[5],
         );
       } else {
         await client.execute(createCommentsSql);
@@ -145,9 +171,62 @@ export async function ensureReviewTables(): Promise<void> {
 
 export async function insertReviewComment(
   input: InsertReviewCommentInput,
+): Promise<ReviewComment> {
+  await ensureReviewTables();
+  return insertReviewCommentWithClient(input, getDbExec());
+}
+
+export async function insertReviewReply(
+  input: InsertReviewCommentInput & {
+    threadId: string;
+    parentCommentId: string;
+  },
+  routeTarget: ReviewResolutionTarget | null,
+  resource: { resourceType: string; resourceId: string },
 ): Promise<ReviewComment> {
   await ensureReviewTables();
   const client = getDbExec();
+  const insertAndRoute = async (tx: DbExec) => {
+    if (routeTarget) {
+      const routedCount = await routeReviewThreadWithClient(
+        tx,
+        input.threadId,
+        routeTarget,
+        resource,
+      );
+      if (routedCount < 1) {
+        throw new Error("Open review thread not found");
+      }
+    }
+    return insertReviewCommentWithClient(input, tx);
+  };
+  if (client.transaction) return client.transaction(insertAndRoute);
+
+  const reply = await insertReviewCommentWithClient(input, client);
+  if (!routeTarget) return reply;
+  try {
+    const routedCount = await routeReviewThreadWithClient(
+      client,
+      input.threadId,
+      routeTarget,
+      resource,
+    );
+    if (routedCount < 1) throw new Error("Open review thread not found");
+    return reply;
+  } catch (error) {
+    await client.execute({
+      sql: `DELETE FROM agent_review_comments
+             WHERE id = ? AND resource_type = ? AND resource_id = ?`,
+      args: [reply.id, resource.resourceType, resource.resourceId],
+    });
+    throw error;
+  }
+}
+
+async function insertReviewCommentWithClient(
+  input: InsertReviewCommentInput,
+  client: DbExec,
+): Promise<ReviewComment> {
   const id = createReviewId("comment");
   const now = new Date().toISOString();
   const comment: ReviewComment = {
@@ -180,6 +259,10 @@ export async function insertReviewComment(
     createdAt: now,
     updatedAt: now,
     metadata: input.metadata ?? null,
+    resolutionNote:
+      typeof input.metadata?.resolutionNote === "string"
+        ? input.metadata.resolutionNote
+        : null,
   };
 
   await client.execute({
@@ -273,18 +356,107 @@ export async function queryReviewComments(
       filterParams.push(input.targetId);
     }
   }
+  if (input.rootOnly) {
+    filters.push("parent_comment_id IS NULL");
+  }
+  if (input.unconsumedOnly) {
+    filters.push("consumed_at IS NULL");
+  }
+  if (input.resolutionTargets !== undefined) {
+    const targets = Array.from(
+      new Set(
+        input.resolutionTargets.filter(
+          (target): target is ReviewResolutionTarget => target !== null,
+        ),
+      ),
+    );
+    const resolutionFilters: string[] = [];
+    if (targets.length > 0) {
+      resolutionFilters.push(
+        `resolution_target IN (${targets.map(() => "?").join(", ")})`,
+      );
+      filterParams.push(...targets);
+    }
+    if (input.resolutionTargets.includes(null)) {
+      resolutionFilters.push("resolution_target IS NULL");
+    }
+    filters.push(
+      resolutionFilters.length > 0
+        ? `(${resolutionFilters.join(" OR ")})`
+        : "1 = 0",
+    );
+  }
 
+  const selectSql = input.rootOnly
+    ? `SELECT ${commentColumns()}
+         FROM (
+           SELECT ${commentColumns()},
+                  ROW_NUMBER() OVER (
+                    PARTITION BY thread_id
+                    ORDER BY created_at ASC, id ASC
+                  ) AS review_thread_rank
+             FROM agent_review_comments
+            WHERE ${filters.join(" AND ")}
+         ) AS distinct_review_threads
+        WHERE review_thread_rank = 1`
+    : `SELECT ${commentColumns()}
+         FROM agent_review_comments
+        WHERE ${filters.join(" AND ")}`;
   const result = await client.execute({
-    sql: `SELECT ${commentColumns()}
-       FROM agent_review_comments
-      WHERE ${filters.join(" AND ")}
-      ORDER BY created_at ASC
+    sql: `${selectSql}
+      ORDER BY created_at ASC${input.rootOnly ? ", id ASC" : ""}
       LIMIT ?`,
     args: [...filterParams, clampLimit(input.limit)],
   });
   return (result.rows ?? []).map(mapCommentRow);
 }
 
+export async function getReviewThreadSummary(
+  input: GetReviewThreadSummaryInput,
+): Promise<ReviewThreadSummary> {
+  await ensureReviewTables();
+  const { clause, params } = input.bypassScope
+    ? { clause: "1 = 1", params: [] as unknown[] }
+    : scopedReviewClause(input.scope);
+  const filters = [
+    "resource_type = ?",
+    "resource_id = ?",
+    clause,
+    "parent_comment_id IS NULL",
+    "deleted_at IS NULL",
+    "status = 'open'",
+  ];
+  const filterParams: unknown[] = [
+    input.resourceType,
+    input.resourceId,
+    ...params,
+  ];
+  if (input.targetId !== undefined) {
+    if (input.targetId === null) {
+      filters.push("target_id IS NULL");
+    } else {
+      filters.push("target_id = ?");
+      filterParams.push(input.targetId);
+    }
+  }
+  const result = await getDbExec().execute({
+    sql: `SELECT COUNT(DISTINCT thread_id) AS open_count,
+                 COUNT(DISTINCT CASE
+                   WHEN (resolution_target IS NULL OR resolution_target <> 'human')
+                    AND consumed_at IS NULL
+                   THEN thread_id
+                 END) AS agent_queue_count
+            FROM agent_review_comments
+           WHERE ${filters.join(" AND ")}`,
+    args: filterParams,
+  });
+  const row = result.rows?.[0];
+  return {
+    openCount: Number(row?.open_count ?? 0),
+    agentQueueCount: Number(row?.agent_queue_count ?? 0),
+  };
+}
+
 export async function getReviewCommentById(
   id: string,
   scope: ReviewScope,
@@ -306,27 +478,106 @@ export async function getReviewCommentById(
   return row ? mapCommentRow(row) : null;
 }
 
+export async function getReviewThreadRoot(
+  threadId: string,
+  resource: { resourceType: string; resourceId: string },
+  scope: ReviewScope,
+  options: { bypassScope?: boolean } = {},
+): Promise<ReviewComment | null> {
+  await ensureReviewTables();
+  const { clause, params } = options.bypassScope
+    ? { clause: "1 = 1", params: [] as unknown[] }
+    : scopedReviewClause(scope);
+  const result = await getDbExec().execute({
+    sql: `SELECT ${commentColumns()}
+       FROM agent_review_comments
+      WHERE thread_id = ?
+        AND resource_type = ?
+        AND resource_id = ?
+        AND parent_comment_id IS NULL
+        AND ${clause}
+      ORDER BY created_at ASC, id ASC
+      LIMIT 1`,
+    args: [threadId, resource.resourceType, resource.resourceId, ...params],
+  });
+  const row = result.rows?.[0];
+  return row ? mapCommentRow(row) : null;
+}
+
 export async function resolveReviewThread(
   threadId: string,
   resolvedBy?: string | null,
   resource?: { resourceType: string; resourceId: string },
+  resolutionNote?: string,
 ): Promise<number> {
   await ensureReviewTables();
+  const client = getDbExec();
+  const resolve = (tx: DbExec) =>
+    resolveReviewThreadWithClient(
+      tx,
+      threadId,
+      resolvedBy,
+      resource,
+      resolutionNote,
+    );
+  return client.transaction ? client.transaction(resolve) : resolve(client);
+}
+
+async function resolveReviewThreadWithClient(
+  client: DbExec,
+  threadId: string,
+  resolvedBy?: string | null,
+  resource?: { resourceType: string; resourceId: string },
+  resolutionNote?: string,
+): Promise<number> {
   const now = new Date().toISOString();
   const resourceClause = resource
     ? "AND resource_type = ? AND resource_id = ?"
     : "";
-  const result = await getDbExec().execute({
+  let rootMetadata: Record<string, unknown> | null = null;
+  if (resolutionNote !== undefined) {
+    const root = await client.execute({
+      sql: `SELECT metadata_json
+         FROM agent_review_comments
+        WHERE thread_id = ?
+          AND parent_comment_id IS NULL
+          AND deleted_at IS NULL
+          ${resourceClause}
+        ORDER BY created_at ASC, id ASC
+        LIMIT 1`,
+      args: [
+        threadId,
+        ...(resource ? [resource.resourceType, resource.resourceId] : []),
+      ],
+    });
+    if (!root.rows?.[0]) {
+      return 0;
+    }
+    rootMetadata = {
+      ...(parseObject(root.rows[0].metadata_json) ?? {}),
+      resolutionNote,
+    };
+  }
+
+  const metadataAssignment =
+    resolutionNote === undefined
+      ? ""
+      : ", metadata_json = CASE WHEN parent_comment_id IS NULL THEN ? ELSE metadata_json END";
+  const result = await client.execute({
     sql: `UPDATE agent_review_comments
         SET status = 'resolved',
             resolved_by = ?,
             resolved_at = ?,
             updated_at = ?
+            ${metadataAssignment}
       WHERE thread_id = ? AND deleted_at IS NULL ${resourceClause}`,
     args: [
       resolvedBy ?? null,
       now,
       now,
+      ...(resolutionNote === undefined
+        ? []
+        : [stringifyOptionalJson(rootMetadata)]),
       threadId,
       ...(resource ? [resource.resourceType, resource.resourceId] : []),
     ],
@@ -334,6 +585,57 @@ export async function resolveReviewThread(
   return result.rowsAffected ?? 0;
 }
 
+export async function routeReviewThread(
+  threadId: string,
+  resolutionTarget: ReviewResolutionTarget,
+  resource: { resourceType: string; resourceId: string },
+): Promise<number> {
+  await ensureReviewTables();
+  return routeReviewThreadWithClient(
+    getDbExec(),
+    threadId,
+    resolutionTarget,
+    resource,
+  );
+}
+
+async function routeReviewThreadWithClient(
+  client: DbExec,
+  threadId: string,
+  resolutionTarget: ReviewResolutionTarget,
+  resource: { resourceType: string; resourceId: string },
+): Promise<number> {
+  const now = new Date().toISOString();
+  const result = await client.execute({
+    sql: `UPDATE agent_review_comments
+        SET resolution_target = ?,
+            consumed_at = CASE WHEN ? = 'agent' THEN NULL ELSE consumed_at END,
+            updated_at = ?
+      WHERE thread_id = ?
+        AND resource_type = ?
+        AND resource_id = ?
+        AND parent_comment_id IS NULL
+        AND status = 'open'
+        AND deleted_at IS NULL`,
+    args: [
+      resolutionTarget,
+      resolutionTarget,
+      now,
+      threadId,
+      resource.resourceType,
+      resource.resourceId,
+    ],
+  });
+  return result.rowsAffected ?? 0;
+}
+
+export async function sendReviewThreadToAgent(
+  threadId: string,
+  resource: { resourceType: string; resourceId: string },
+): Promise<number> {
+  return routeReviewThread(threadId, "agent", resource);
+}
+
 export async function deleteReviewComment(
   id: string,
   deletedBy?: string | null,
@@ -560,6 +862,7 @@ function scopedReviewClause(scope: ReviewScope): {
 }
 
 function mapCommentRow(row: Record<string, unknown>): ReviewComment {
+  const metadata = parseObject(row.metadata_json);
   return {
     id: String(row.id),
     resourceType: String(row.resource_type),
@@ -586,7 +889,11 @@ function mapCommentRow(row: Record<string, unknown>): ReviewComment {
     deletedAt: nullableString(row.deleted_at),
     createdAt: String(row.created_at),
     updatedAt: String(row.updated_at),
-    metadata: parseObject(row.metadata_json),
+    metadata,
+    resolutionNote:
+      typeof metadata?.resolutionNote === "string"
+        ? metadata.resolutionNote
+        : null,
   };
 }
 

package/corpus/core/src/review/types.ts

@@ -75,6 +75,10 @@ export interface ReviewComment {
   createdAt: string;
   updatedAt: string;
   metadata: Record<string, unknown> | null;
+  /** Persisted on the root comment's metadata when a thread is resolved. */
+  resolutionNote?: string | null;
+  /** Caller-specific capability computed by list-review-comments. */
+  canDelete?: boolean;
 }
 
 export interface ReviewStatusEntry {

package/corpus/core/src/secrets/crypto.ts

@@ -1,17 +1,23 @@
 /**
  * Shared AES-256-GCM encryption for secret values at rest.
  *
- * Used by both the framework secrets vault (`app_secrets`) and per-user/per-org
- * credentials (`resolveCredential` / `saveCredential`, stored in `settings`) so
- * there is a single crypto implementation and a single key story.
+ * Used by the framework secrets vault, per-user/per-org credentials
+ * (`resolveCredential` / `saveCredential`, stored in `settings`), and other
+ * column-level encrypted values. The `app_secrets` storage layer uses the
+ * shared-key variant below because workspace-scoped vault rows are readable by
+ * sibling apps in the same workspace. When a deployment has not been given
+ * shared key material yet, that variant falls back to the app-scoped key so
+ * existing single-app deployments can keep reading and writing secrets while
+ * they migrate to the shared key.
  *
- * The encryption key is derived from `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when
- * set, then `SECRETS_ENCRYPTION_KEY`, then `BETTER_AUTH_SECRET`. The app-scoped
- * key lets a local multi-app workspace read one app's encrypted production data
- * without replacing the shared local auth secret. In production we refuse to
- * start without configured key material — a CWD-derived fallback would be
- * effectively static (e.g. `/var/task` on Lambda), so anyone with read access
- * to the DB could decrypt every secret.
+ * The default encryption key is derived from
+ * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then `SECRETS_ENCRYPTION_KEY`,
+ * then `BETTER_AUTH_SECRET`. The app-scoped key lets a local multi-app
+ * workspace read one app's encrypted production data without replacing the
+ * shared local auth secret. In production we refuse to start without
+ * configured key material — a CWD-derived fallback would be effectively
+ * static (e.g. `/var/task` on Lambda), so anyone with read access to the DB
+ * could decrypt every secret.
  *
  * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
  * lets readers distinguish ciphertext from legacy plaintext during migration.
@@ -67,45 +73,26 @@ function appScopedEncryptionKey(): string | undefined {
     : undefined;
 }
 
-/**
- * Derive a 32-byte AES key from the configured secret material via SHA-256.
- * Re-derived per call (cheap, stateless, and makes rotation easy).
- */
-export function getSecretEncryptionKey(): Buffer {
+function sharedEncryptionKeyMaterial(): string | undefined {
+  if (typeof process === "undefined") return undefined;
+  return process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;
+}
+
+function deriveSecretEncryptionKey(
+  explicit: string | undefined,
+  errorMessage: string,
+  warningMessage: string,
+): Buffer {
   const { createHash } = requireNodeCrypto();
-  const explicit =
-    appScopedEncryptionKey() ||
-    (typeof process === "undefined"
-      ? undefined
-      : process.env.SECRETS_ENCRYPTION_KEY) ||
-    (typeof process === "undefined"
-      ? undefined
-      : process.env.BETTER_AUTH_SECRET);
 
   if (!explicit) {
     if (processNodeEnv() === "production") {
-      const appName =
-        typeof process === "undefined"
-          ? undefined
-          : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.
-              .toUpperCase()
-              .replace(/[^A-Z0-9]+/g, "_")
-              .replace(/^_+|_+$/g, "");
-      throw new Error(
-        "[agent-native/secrets] Refusing to start in production without an encryption key. " +
-          `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : ""}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +
-          "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
-          "which means anyone with read access to the secrets table could decrypt every user's secrets.",
-      );
+      throw new Error(errorMessage);
     }
     if (!_warnedFallback) {
       _warnedFallback = true;
       // eslint-disable-next-line no-console
-      console.warn(
-        "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. " +
-          "Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. " +
-          "Production deploys without one of these env vars now hard-fail.",
-      );
+      console.warn(warningMessage);
     }
   }
 
@@ -113,10 +100,56 @@ export function getSecretEncryptionKey(): Buffer {
   return createHash("sha256").update(material).digest();
 }
 
-/** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */
-export function encryptSecretValue(plaintext: string): string {
+/**
+ * Derive the key used by generic encrypted values such as credentials and
+ * OAuth tokens. App-specific key material is allowed for these app-local
+ * values.
+ */
+export function getSecretEncryptionKey(): Buffer {
+  const appName =
+    typeof process === "undefined"
+      ? undefined
+      : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.
+          .toUpperCase()
+          .replace(/[^A-Z0-9]+/g, "_")
+          .replace(/^_+|_+$/g, "");
+  return deriveSecretEncryptionKey(
+    appScopedEncryptionKey() || sharedEncryptionKeyMaterial(),
+    "[agent-native/secrets] Refusing to start in production without an encryption key. " +
+      `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : ""}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +
+      "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
+      "which means anyone with read access to the DB could decrypt every secret.",
+    "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. " +
+      "Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. " +
+      "Production deploys without one of these env vars now hard-fail.",
+  );
+}
+
+/**
+ * Derive the preferred workspace-shared key used by `app_secrets` rows.
+ * Unlike generic column-level encryption, workspace vault data should decrypt
+ * in sibling apps, so `SECRETS_ENCRYPTION_KEY` / `BETTER_AUTH_SECRET` take
+ * precedence. The app-scoped key remains a compatibility fallback for
+ * deployments that have not configured shared material yet; once the shared
+ * key is configured, writes use it and reads still fall back to old rows.
+ */
+export function getSharedSecretEncryptionKey(): Buffer {
+  return deriveSecretEncryptionKey(
+    sharedEncryptionKeyMaterial() || appScopedEncryptionKey(),
+    "[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. " +
+      "Set SECRETS_ENCRYPTION_KEY, BETTER_AUTH_SECRET, or the app-scoped *_SECRETS_ENCRYPTION_KEY in the deploy environment.",
+    "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using app-scoped or machine-local fallback for workspace secrets. " +
+      "Set SECRETS_ENCRYPTION_KEY or BETTER_AUTH_SECRET in every workspace app so sibling apps share vault rows.",
+  );
+}
+
+/** Whether this deployment has stable workspace-shared key material. */
+export function hasSharedSecretEncryptionKeyMaterial(): boolean {
+  return Boolean(sharedEncryptionKeyMaterial());
+}
+
+function encryptWithKey(plaintext: string, key: Buffer): string {
   const { createCipheriv, randomBytes } = requireNodeCrypto();
-  const key = getSecretEncryptionKey();
   const iv = randomBytes(12);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
@@ -124,8 +157,7 @@ export function encryptSecretValue(plaintext: string): string {
   return `v1:${iv.toString("hex")}:${ct.toString("hex")}:${tag.toString("hex")}`;
 }
 
-/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */
-export function decryptSecretValue(encrypted: string): string {
+function decryptWithKey(encrypted: string, key: Buffer): string {
   const { createDecipheriv } = requireNodeCrypto();
   if (!encrypted.startsWith("v1:")) {
     throw new Error("Unrecognised secret encoding");
@@ -134,7 +166,6 @@ export function decryptSecretValue(encrypted: string): string {
   if (!ivHex || !ctHex || !tagHex) {
     throw new Error("Corrupt secret payload");
   }
-  const key = getSecretEncryptionKey();
   const decipher = createDecipheriv(
     "aes-256-gcm",
     key,
@@ -148,6 +179,26 @@ export function decryptSecretValue(encrypted: string): string {
   return pt.toString("utf8");
 }
 
+/** Encrypt a plain-text value with the generic app-local key. */
+export function encryptSecretValue(plaintext: string): string {
+  return encryptWithKey(plaintext, getSecretEncryptionKey());
+}
+
+/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */
+export function decryptSecretValue(encrypted: string): string {
+  return decryptWithKey(encrypted, getSecretEncryptionKey());
+}
+
+/** Encrypt a workspace-shared `app_secrets` value. */
+export function encryptSharedSecretValue(plaintext: string): string {
+  return encryptWithKey(plaintext, getSharedSecretEncryptionKey());
+}
+
+/** Decrypt a workspace-shared `app_secrets` value. */
+export function decryptSharedSecretValue(encrypted: string): string {
+  return decryptWithKey(encrypted, getSharedSecretEncryptionKey());
+}
+
 /**
  * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by
  * three hex segments. Intentionally strict so a legacy plaintext credential

package/corpus/core/src/secrets/index.ts

@@ -38,7 +38,8 @@ export { APP_SECRETS_CREATE_SQL, appSecrets } from "./schema.js";
 
 // AES-256-GCM helpers for column-level encryption of per-row secret values
 // (e.g. a per-record share password) that don't fit the keyed app_secrets /
-// credentials stores. Same key story as the vault.
+// credentials stores. These use the app-local key, unlike the workspace-shared
+// app_secrets storage layer.
 export {
   encryptSecretValue,
   decryptSecretValue,

package/corpus/core/src/secrets/schema.ts

@@ -22,6 +22,8 @@ export const appSecrets = table("app_secrets", {
   key: text("key").notNull(),
   /** Encrypted value — never return this through any API. */
   encryptedValue: text("encrypted_value").notNull(),
+  /** Preferred workspace-shared ciphertext; nullable during key migration. */
+  sharedEncryptedValue: text("shared_encrypted_value"),
   /** Optional human-readable description (used for ad-hoc keys). */
   description: text("description"),
   /** JSON array of allowed URL origins. Null = allow all. */
@@ -41,6 +43,7 @@ export const APP_SECRETS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS app_secrets (
   scope_id TEXT NOT NULL,
   key TEXT NOT NULL,
   encrypted_value TEXT NOT NULL,
+  shared_encrypted_value TEXT,
   description TEXT,
   url_allowlist TEXT,
   created_at INTEGER NOT NULL,