@ampless/backend 1.0.0-alpha.49 → 1.0.0-alpha.50

package/dist/events/processor-trusted.js

@@ -192,7 +192,7 @@ function createProcessorTrustedHandler(opts) {
           const result = await rawDdb.send(
             new GetItemCommand({
               TableName: PLUGIN_SECRET_TABLE,
-              Key: marshall({ siteId: "default", sk })
+              Key: marshall({ sk })
             })
           );
           if (!result.Item) {

package/dist/functions/plugin-secret-handler.js

@@ -74,13 +74,13 @@ async function handleSet(args) {
   await ddb.send(
     new PutItemCommand({
       TableName: secretTable,
-      Item: marshall({ siteId: "default", sk, value: ciphertext })
+      Item: marshall({ sk, value: ciphertext })
     })
   );
   await ddb.send(
     new PutItemCommand({
       TableName: indicatorTable,
-      Item: marshall({ siteId: "default", sk, lastSetAt: now })
+      Item: marshall({ sk, lastSetAt: now })
     })
   );
   return "ok";
@@ -99,13 +99,13 @@ async function handleClear(args) {
   await ddb.send(
     new DeleteItemCommand({
       TableName: secretTable,
-      Key: marshall({ siteId: "default", sk })
+      Key: marshall({ sk })
     })
   );
   await ddb.send(
     new DeleteItemCommand({
       TableName: indicatorTable,
-      Key: marshall({ siteId: "default", sk })
+      Key: marshall({ sk })
     })
   );
   return "ok";

package/dist/index.js

@@ -455,17 +455,19 @@ function amplessSchemaModels(a, opts = {}) {
     //     access scoped to the table the Lambda needs.
     //
     // Storage key convention:
-    //   siteId = 'default'   (single-site architecture)
     //   sk = `plugins.${instanceId ?? name}.${fieldKey}`
     //
+    // Single-site architecture: no `siteId` partition column. The same
+    // single-table convention as KvStore / Post / Page / Media after
+    // the `remove-siteid-from-schema` migration.
+    //
     // DynamoDB auto-encrypts at rest (AWS-managed KMS key). Secrets
     // never flow to the S3 site-settings mirror because the trusted
     // processor only queries KvStore (pk='siteconfig') for that path —
     // PluginSecret is a structurally separate table.
     PluginSecret: a.model({
-      // Single-site architecture: siteId is always 'default'.
-      siteId: a.string().required(),
-      // Composite sort key: `plugins.<instanceId>.<fieldKey>`
+      // Sort key (also the partition key — single-id identifier):
+      // `plugins.<instanceId>.<fieldKey>`
       sk: a.string().required(),
       // The secret value stored as AES-256-GCM ciphertext (base64).
       // Format: base64( IV[12] || ciphertext || authTag[16] ).
@@ -480,7 +482,7 @@ function amplessSchemaModels(a, opts = {}) {
       // / deploy artifact access, NOT defeated for a malicious
       // trusted plugin co-located in the same Lambda.
       value: a.string().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => [
+    }).identifier(["sk"]).authorization((allow) => [
       // Deny-all-via-AppSync sentinel. See the comment above this
       // model for why this is a non-existent group name and how the
       // real Lambda access path works (DDB SDK + IAM grants).
@@ -501,14 +503,13 @@ function amplessSchemaModels(a, opts = {}) {
     // row is at most stale-indicator-but-no-secret, which degrades
     // gracefully as a false "stored" indicator in the UI).
     PluginSecretIndicator: a.model({
-      siteId: a.string().required(),
       // Same sort-key format as PluginSecret:
       //   `plugins.${instanceId ?? name}.${fieldKey}`
       sk: a.string().required(),
       // ISO 8601 datetime string — set by plugin-secret-handler on
       // every write. Admin UI may show this as "last updated" hint.
       lastSetAt: a.datetime().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => [
+    }).identifier(["sk"]).authorization((allow) => [
       // Admin/editor have AppSync read for `hasPluginSecret` and
       // direct write+delete as a recovery path. The Lambda is the
       // normal write path (it calls the DDB SDK directly with IAM,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.49",
+  "version": "1.0.0-alpha.50",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",