@eide/foir-proto-ts 0.36.0 → 0.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-proto-ts",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "type": "module",
   "exports": {
     "./analytics/v1/analytics_pb": "./src/analytics/v1/analytics_pb.js",
@@ -35,6 +35,8 @@
     "./records/v1/records_connect": "./src/records/v1/records_connect.js",
     "./schedules/v1/schedules_pb": "./src/schedules/v1/schedules_pb.js",
     "./schedules/v1/schedules_connect": "./src/schedules/v1/schedules_connect.js",
+    "./secrets/v1/secrets_pb": "./src/secrets/v1/secrets_pb.js",
+    "./secrets/v1/secrets_connect": "./src/secrets/v1/secrets_connect.js",
     "./segments/v1/segments_pb": "./src/segments/v1/segments_pb.js",
     "./segments/v1/segments_connect": "./src/segments/v1/segments_connect.js",
     "./settings/v1/settings_pb": "./src/settings/v1/settings_pb.js",

package/src/secrets/v1/secrets_connect.d.ts

@@ -0,0 +1,80 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "import_extension=js"
+// @generated from file secrets/v1/secrets.proto (package secrets.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { DeleteSecretRequest, DeleteSecretResponse, GetSecretRequest, GetSecretResponse, ListSecretsRequest, ListSecretsResponse, PurgeSoftDeletedRequest, PurgeSoftDeletedResponse, PutSecretRequest, PutSecretResponse, RestoreSecretRequest, RestoreSecretResponse, RotateSecretRequest, RotateSecretResponse } from "./secrets_pbjs";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service secrets.v1.SecretsService
+ */
+export declare const SecretsService: {
+  readonly typeName: "secrets.v1.SecretsService",
+  readonly methods: {
+    /**
+     * @generated from rpc secrets.v1.SecretsService.PutSecret
+     */
+    readonly putSecret: {
+      readonly name: "PutSecret",
+      readonly I: typeof PutSecretRequest,
+      readonly O: typeof PutSecretResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.GetSecret
+     */
+    readonly getSecret: {
+      readonly name: "GetSecret",
+      readonly I: typeof GetSecretRequest,
+      readonly O: typeof GetSecretResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.ListSecrets
+     */
+    readonly listSecrets: {
+      readonly name: "ListSecrets",
+      readonly I: typeof ListSecretsRequest,
+      readonly O: typeof ListSecretsResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.RotateSecret
+     */
+    readonly rotateSecret: {
+      readonly name: "RotateSecret",
+      readonly I: typeof RotateSecretRequest,
+      readonly O: typeof RotateSecretResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.DeleteSecret
+     */
+    readonly deleteSecret: {
+      readonly name: "DeleteSecret",
+      readonly I: typeof DeleteSecretRequest,
+      readonly O: typeof DeleteSecretResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.RestoreSecret
+     */
+    readonly restoreSecret: {
+      readonly name: "RestoreSecret",
+      readonly I: typeof RestoreSecretRequest,
+      readonly O: typeof RestoreSecretResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.PurgeSoftDeleted
+     */
+    readonly purgeSoftDeleted: {
+      readonly name: "PurgeSoftDeleted",
+      readonly I: typeof PurgeSoftDeletedRequest,
+      readonly O: typeof PurgeSoftDeletedResponse,
+      readonly kind: MethodKind.Unary,
+    },
+  }
+};
+

package/src/secrets/v1/secrets_connect.js

@@ -0,0 +1,80 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "import_extension=js"
+// @generated from file secrets/v1/secrets.proto (package secrets.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { DeleteSecretRequest, DeleteSecretResponse, GetSecretRequest, GetSecretResponse, ListSecretsRequest, ListSecretsResponse, PurgeSoftDeletedRequest, PurgeSoftDeletedResponse, PutSecretRequest, PutSecretResponse, RestoreSecretRequest, RestoreSecretResponse, RotateSecretRequest, RotateSecretResponse } from "./secrets_pbjs";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service secrets.v1.SecretsService
+ */
+export const SecretsService = {
+  typeName: "secrets.v1.SecretsService",
+  methods: {
+    /**
+     * @generated from rpc secrets.v1.SecretsService.PutSecret
+     */
+    putSecret: {
+      name: "PutSecret",
+      I: PutSecretRequest,
+      O: PutSecretResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.GetSecret
+     */
+    getSecret: {
+      name: "GetSecret",
+      I: GetSecretRequest,
+      O: GetSecretResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.ListSecrets
+     */
+    listSecrets: {
+      name: "ListSecrets",
+      I: ListSecretsRequest,
+      O: ListSecretsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.RotateSecret
+     */
+    rotateSecret: {
+      name: "RotateSecret",
+      I: RotateSecretRequest,
+      O: RotateSecretResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.DeleteSecret
+     */
+    deleteSecret: {
+      name: "DeleteSecret",
+      I: DeleteSecretRequest,
+      O: DeleteSecretResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.RestoreSecret
+     */
+    restoreSecret: {
+      name: "RestoreSecret",
+      I: RestoreSecretRequest,
+      O: RestoreSecretResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc secrets.v1.SecretsService.PurgeSoftDeleted
+     */
+    purgeSoftDeleted: {
+      name: "PurgeSoftDeleted",
+      I: PurgeSoftDeletedRequest,
+      O: PurgeSoftDeletedResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+};
+

package/src/secrets/v1/secrets_pb.d.ts

@@ -0,0 +1,546 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "import_extension=js"
+// @generated from file secrets/v1/secrets.proto (package secrets.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+
+/**
+ * Describes the file secrets/v1/secrets.proto.
+ */
+export declare const file_secrets_v1_secrets: GenFile;
+
+/**
+ * SecretMetadata is the listing-shape — never carries plaintext.
+ *
+ * @generated from message secrets.v1.SecretMetadata
+ */
+export declare type SecretMetadata = Message<"secrets.v1.SecretMetadata"> & {
+  /**
+   * @generated from field: string ref = 1;
+   */
+  ref: string;
+
+  /**
+   * @generated from field: string tenant_id = 2;
+   */
+  tenantId: string;
+
+  /**
+   * @generated from field: string project_id = 3;
+   */
+  projectId: string;
+
+  /**
+   * @generated from field: secrets.v1.OwnerKind owner_kind = 4;
+   */
+  ownerKind: OwnerKind;
+
+  /**
+   * Empty when owner_kind = PROJECT.
+   *
+   * @generated from field: string owner_id = 5;
+   */
+  ownerId: string;
+
+  /**
+   * @generated from field: string kind = 6;
+   */
+  kind: string;
+
+  /**
+   * @generated from field: string label = 7;
+   */
+  label: string;
+
+  /**
+   * @generated from field: optional google.protobuf.Timestamp expires_at = 8;
+   */
+  expiresAt?: Timestamp | undefined;
+
+  /**
+   * @generated from field: optional google.protobuf.Timestamp last_read_at = 9;
+   */
+  lastReadAt?: Timestamp | undefined;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp last_written_at = 10;
+   */
+  lastWrittenAt?: Timestamp | undefined;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 11;
+   */
+  createdAt?: Timestamp | undefined;
+
+  /**
+   * @generated from field: optional string created_by = 12;
+   */
+  createdBy?: string | undefined;
+
+  /**
+   * @generated from field: optional google.protobuf.Timestamp soft_deleted_at = 13;
+   */
+  softDeletedAt?: Timestamp | undefined;
+
+  /**
+   * @generated from field: optional google.protobuf.Timestamp purge_after = 14;
+   */
+  purgeAfter?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message secrets.v1.SecretMetadata.
+ * Use `create(SecretMetadataSchema)` to create a new message.
+ */
+export declare const SecretMetadataSchema: GenMessage<SecretMetadata>;
+
+/**
+ * -----------------------------------------------------------------------------
+ * PutSecret — write a new secret, return its ref.
+ *
+ * The caller is responsible for binding the returned ref to a record
+ * (writing it into a SecretRef field + a secret_references row in the main
+ * DB). A failure of that follow-up step leaves an orphaned vault row that
+ * the orphan sweeper soft-deletes after a grace window.
+ * -----------------------------------------------------------------------------
+ *
+ * @generated from message secrets.v1.PutSecretRequest
+ */
+export declare type PutSecretRequest = Message<"secrets.v1.PutSecretRequest"> & {
+  /**
+   * @generated from field: string tenant_id = 1;
+   */
+  tenantId: string;
+
+  /**
+   * @generated from field: string project_id = 2;
+   */
+  projectId: string;
+
+  /**
+   * @generated from field: secrets.v1.OwnerKind owner_kind = 3;
+   */
+  ownerKind: OwnerKind;
+
+  /**
+   * REQUIRED when owner_kind = APP (the app name) or CUSTOMER (the customer id).
+   * MUST be empty when owner_kind = PROJECT.
+   *
+   * @generated from field: string owner_id = 4;
+   */
+  ownerId: string;
+
+  /**
+   * Free-form secret kind tag (e.g. "apns_p8", "oauth_token", "generic").
+   * Conventional set documented in docs/platform/secret-vault.md.
+   *
+   * @generated from field: string kind = 5;
+   */
+  kind: string;
+
+  /**
+   * Optional human-friendly label — stored verbatim, surfaced in admin UI.
+   *
+   * @generated from field: string label = 6;
+   */
+  label: string;
+
+  /**
+   * @generated from field: bytes plaintext = 7;
+   */
+  plaintext: Uint8Array;
+
+  /**
+   * @generated from field: optional google.protobuf.Timestamp expires_at = 8;
+   */
+  expiresAt?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message secrets.v1.PutSecretRequest.
+ * Use `create(PutSecretRequestSchema)` to create a new message.
+ */
+export declare const PutSecretRequestSchema: GenMessage<PutSecretRequest>;
+
+/**
+ * @generated from message secrets.v1.PutSecretResponse
+ */
+export declare type PutSecretResponse = Message<"secrets.v1.PutSecretResponse"> & {
+  /**
+   * @generated from field: string ref = 1;
+   */
+  ref: string;
+};
+
+/**
+ * Describes the message secrets.v1.PutSecretResponse.
+ * Use `create(PutSecretResponseSchema)` to create a new message.
+ */
+export declare const PutSecretResponseSchema: GenMessage<PutSecretResponse>;
+
+/**
+ * -----------------------------------------------------------------------------
+ * GetSecret — fetch plaintext, audit-logged with caller-supplied purpose.
+ * -----------------------------------------------------------------------------
+ *
+ * @generated from message secrets.v1.GetSecretRequest
+ */
+export declare type GetSecretRequest = Message<"secrets.v1.GetSecretRequest"> & {
+  /**
+   * @generated from field: string ref = 1;
+   */
+  ref: string;
+
+  /**
+   * OPTIONAL human-readable reason recorded into secret_events.purpose.
+   * Conventionally describes the consumer's domain action — "mint_apns_jwt",
+   * "shopify_admin_api_call", "fcm_v1_dispatch" — so the audit trail says why
+   * a decrypt happened, not just that one did.
+   *
+   * @generated from field: string purpose = 2;
+   */
+  purpose: string;
+};
+
+/**
+ * Describes the message secrets.v1.GetSecretRequest.
+ * Use `create(GetSecretRequestSchema)` to create a new message.
+ */
+export declare const GetSecretRequestSchema: GenMessage<GetSecretRequest>;
+
+/**
+ * @generated from message secrets.v1.GetSecretResponse
+ */
+export declare type GetSecretResponse = Message<"secrets.v1.GetSecretResponse"> & {
+  /**
+   * @generated from field: bytes plaintext = 1;
+   */
+  plaintext: Uint8Array;
+
+  /**
+   * @generated from field: secrets.v1.SecretMetadata metadata = 2;
+   */
+  metadata?: SecretMetadata | undefined;
+};
+
+/**
+ * Describes the message secrets.v1.GetSecretResponse.
+ * Use `create(GetSecretResponseSchema)` to create a new message.
+ */
+export declare const GetSecretResponseSchema: GenMessage<GetSecretResponse>;
+
+/**
+ * -----------------------------------------------------------------------------
+ * ListSecrets — metadata-only listing, scoped by owner filters.
+ * -----------------------------------------------------------------------------
+ *
+ * @generated from message secrets.v1.ListSecretsRequest
+ */
+export declare type ListSecretsRequest = Message<"secrets.v1.ListSecretsRequest"> & {
+  /**
+   * @generated from field: string tenant_id = 1;
+   */
+  tenantId: string;
+
+  /**
+   * @generated from field: string project_id = 2;
+   */
+  projectId: string;
+
+  /**
+   * OWNER_KIND_UNSPECIFIED returns all visible owner kinds for the caller.
+   *
+   * @generated from field: secrets.v1.OwnerKind owner_kind = 3;
+   */
+  ownerKind: OwnerKind;
+
+  /**
+   * @generated from field: string owner_id = 4;
+   */
+  ownerId: string;
+
+  /**
+   * @generated from field: string kind = 5;
+   */
+  kind: string;
+
+  /**
+   * Defaults to false — soft-deleted rows are hidden.
+   *
+   * @generated from field: bool include_soft_deleted = 6;
+   */
+  includeSoftDeleted: boolean;
+};
+
+/**
+ * Describes the message secrets.v1.ListSecretsRequest.
+ * Use `create(ListSecretsRequestSchema)` to create a new message.
+ */
+export declare const ListSecretsRequestSchema: GenMessage<ListSecretsRequest>;
+
+/**
+ * @generated from message secrets.v1.ListSecretsResponse
+ */
+export declare type ListSecretsResponse = Message<"secrets.v1.ListSecretsResponse"> & {
+  /**
+   * @generated from field: repeated secrets.v1.SecretMetadata secrets = 1;
+   */
+  secrets: SecretMetadata[];
+};
+
+/**
+ * Describes the message secrets.v1.ListSecretsResponse.
+ * Use `create(ListSecretsResponseSchema)` to create a new message.
+ */
+export declare const ListSecretsResponseSchema: GenMessage<ListSecretsResponse>;
+
+/**
+ * -----------------------------------------------------------------------------
+ * RotateSecret — write new plaintext, swap every reference, soft-delete the
+ * old vault row, atomically.
+ * -----------------------------------------------------------------------------
+ *
+ * @generated from message secrets.v1.RotateSecretRequest
+ */
+export declare type RotateSecretRequest = Message<"secrets.v1.RotateSecretRequest"> & {
+  /**
+   * @generated from field: string ref = 1;
+   */
+  ref: string;
+
+  /**
+   * @generated from field: bytes plaintext = 2;
+   */
+  plaintext: Uint8Array;
+
+  /**
+   * @generated from field: optional google.protobuf.Timestamp expires_at = 3;
+   */
+  expiresAt?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message secrets.v1.RotateSecretRequest.
+ * Use `create(RotateSecretRequestSchema)` to create a new message.
+ */
+export declare const RotateSecretRequestSchema: GenMessage<RotateSecretRequest>;
+
+/**
+ * @generated from message secrets.v1.RotateSecretResponse
+ */
+export declare type RotateSecretResponse = Message<"secrets.v1.RotateSecretResponse"> & {
+  /**
+   * @generated from field: string new_ref = 1;
+   */
+  newRef: string;
+};
+
+/**
+ * Describes the message secrets.v1.RotateSecretResponse.
+ * Use `create(RotateSecretResponseSchema)` to create a new message.
+ */
+export declare const RotateSecretResponseSchema: GenMessage<RotateSecretResponse>;
+
+/**
+ * -----------------------------------------------------------------------------
+ * DeleteSecret — soft-delete with TTL. Restorable via RestoreSecret until
+ * purge_after passes; PurgeSoftDeleted then drops the row.
+ *
+ * If the secret is referenced from any record in the main DB, the on_delete
+ * directive on the SecretRef field decides between block (CodeFailedPrecondition)
+ * and cascade (clears the field + soft-deletes).
+ * -----------------------------------------------------------------------------
+ *
+ * @generated from message secrets.v1.DeleteSecretRequest
+ */
+export declare type DeleteSecretRequest = Message<"secrets.v1.DeleteSecretRequest"> & {
+  /**
+   * @generated from field: string ref = 1;
+   */
+  ref: string;
+};
+
+/**
+ * Describes the message secrets.v1.DeleteSecretRequest.
+ * Use `create(DeleteSecretRequestSchema)` to create a new message.
+ */
+export declare const DeleteSecretRequestSchema: GenMessage<DeleteSecretRequest>;
+
+/**
+ * @generated from message secrets.v1.DeleteSecretResponse
+ */
+export declare type DeleteSecretResponse = Message<"secrets.v1.DeleteSecretResponse"> & {
+};
+
+/**
+ * Describes the message secrets.v1.DeleteSecretResponse.
+ * Use `create(DeleteSecretResponseSchema)` to create a new message.
+ */
+export declare const DeleteSecretResponseSchema: GenMessage<DeleteSecretResponse>;
+
+/**
+ * @generated from message secrets.v1.RestoreSecretRequest
+ */
+export declare type RestoreSecretRequest = Message<"secrets.v1.RestoreSecretRequest"> & {
+  /**
+   * @generated from field: string ref = 1;
+   */
+  ref: string;
+};
+
+/**
+ * Describes the message secrets.v1.RestoreSecretRequest.
+ * Use `create(RestoreSecretRequestSchema)` to create a new message.
+ */
+export declare const RestoreSecretRequestSchema: GenMessage<RestoreSecretRequest>;
+
+/**
+ * @generated from message secrets.v1.RestoreSecretResponse
+ */
+export declare type RestoreSecretResponse = Message<"secrets.v1.RestoreSecretResponse"> & {
+};
+
+/**
+ * Describes the message secrets.v1.RestoreSecretResponse.
+ * Use `create(RestoreSecretResponseSchema)` to create a new message.
+ */
+export declare const RestoreSecretResponseSchema: GenMessage<RestoreSecretResponse>;
+
+/**
+ * @generated from message secrets.v1.PurgeSoftDeletedRequest
+ */
+export declare type PurgeSoftDeletedRequest = Message<"secrets.v1.PurgeSoftDeletedRequest"> & {
+  /**
+   * OPTIONAL. When unset, all eligible rows across every project the caller
+   * is authorized for are purged. Operators run this from CLI.
+   *
+   * @generated from field: string tenant_id = 1;
+   */
+  tenantId: string;
+
+  /**
+   * @generated from field: string project_id = 2;
+   */
+  projectId: string;
+};
+
+/**
+ * Describes the message secrets.v1.PurgeSoftDeletedRequest.
+ * Use `create(PurgeSoftDeletedRequestSchema)` to create a new message.
+ */
+export declare const PurgeSoftDeletedRequestSchema: GenMessage<PurgeSoftDeletedRequest>;
+
+/**
+ * @generated from message secrets.v1.PurgeSoftDeletedResponse
+ */
+export declare type PurgeSoftDeletedResponse = Message<"secrets.v1.PurgeSoftDeletedResponse"> & {
+  /**
+   * @generated from field: int64 purged_count = 1;
+   */
+  purgedCount: bigint;
+};
+
+/**
+ * Describes the message secrets.v1.PurgeSoftDeletedResponse.
+ * Use `create(PurgeSoftDeletedResponseSchema)` to create a new message.
+ */
+export declare const PurgeSoftDeletedResponseSchema: GenMessage<PurgeSoftDeletedResponse>;
+
+/**
+ * OwnerKind identifies the entity that owns a secret. Tenant-wide secrets
+ * are intentionally excluded — tenants are workspaces of projects, not data
+ * containers.
+ *
+ * @generated from enum secrets.v1.OwnerKind
+ */
+export enum OwnerKind {
+  /**
+   * @generated from enum value: OWNER_KIND_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: OWNER_KIND_PROJECT = 1;
+   */
+  PROJECT = 1,
+
+  /**
+   * @generated from enum value: OWNER_KIND_APP = 2;
+   */
+  APP = 2,
+
+  /**
+   * @generated from enum value: OWNER_KIND_CUSTOMER = 3;
+   */
+  CUSTOMER = 3,
+}
+
+/**
+ * Describes the enum secrets.v1.OwnerKind.
+ */
+export declare const OwnerKindSchema: GenEnum<OwnerKind>;
+
+/**
+ * @generated from service secrets.v1.SecretsService
+ */
+export declare const SecretsService: GenService<{
+  /**
+   * @generated from rpc secrets.v1.SecretsService.PutSecret
+   */
+  putSecret: {
+    methodKind: "unary";
+    input: typeof PutSecretRequestSchema;
+    output: typeof PutSecretResponseSchema;
+  },
+  /**
+   * @generated from rpc secrets.v1.SecretsService.GetSecret
+   */
+  getSecret: {
+    methodKind: "unary";
+    input: typeof GetSecretRequestSchema;
+    output: typeof GetSecretResponseSchema;
+  },
+  /**
+   * @generated from rpc secrets.v1.SecretsService.ListSecrets
+   */
+  listSecrets: {
+    methodKind: "unary";
+    input: typeof ListSecretsRequestSchema;
+    output: typeof ListSecretsResponseSchema;
+  },
+  /**
+   * @generated from rpc secrets.v1.SecretsService.RotateSecret
+   */
+  rotateSecret: {
+    methodKind: "unary";
+    input: typeof RotateSecretRequestSchema;
+    output: typeof RotateSecretResponseSchema;
+  },
+  /**
+   * @generated from rpc secrets.v1.SecretsService.DeleteSecret
+   */
+  deleteSecret: {
+    methodKind: "unary";
+    input: typeof DeleteSecretRequestSchema;
+    output: typeof DeleteSecretResponseSchema;
+  },
+  /**
+   * @generated from rpc secrets.v1.SecretsService.RestoreSecret
+   */
+  restoreSecret: {
+    methodKind: "unary";
+    input: typeof RestoreSecretRequestSchema;
+    output: typeof RestoreSecretResponseSchema;
+  },
+  /**
+   * @generated from rpc secrets.v1.SecretsService.PurgeSoftDeleted
+   */
+  purgeSoftDeleted: {
+    methodKind: "unary";
+    input: typeof PurgeSoftDeletedRequestSchema;
+    output: typeof PurgeSoftDeletedResponseSchema;
+  },
+}>;
+

package/src/secrets/v1/secrets_pb.js

@@ -0,0 +1,141 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "import_extension=js"
+// @generated from file secrets/v1/secrets.proto (package secrets.v1, syntax proto3)
+/* eslint-disable */
+
+import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../buf/validate/validate_pb.js";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+
+/**
+ * Describes the file secrets/v1/secrets.proto.
+ */
+export const file_secrets_v1_secrets = /*@__PURE__*/
+  fileDesc("ChhzZWNyZXRzL3YxL3NlY3JldHMucHJvdG8SCnNlY3JldHMudjEiywQKDlNlY3JldE1ldGFkYXRhEgsKA3JlZhgBIAEoCRIRCgl0ZW5hbnRfaWQYAiABKAkSEgoKcHJvamVjdF9pZBgDIAEoCRIpCgpvd25lcl9raW5kGAQgASgOMhUuc2VjcmV0cy52MS5Pd25lcktpbmQSEAoIb3duZXJfaWQYBSABKAkSDAoEa2luZBgGIAEoCRINCgVsYWJlbBgHIAEoCRIzCgpleHBpcmVzX2F0GAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEgAiAEBEjUKDGxhc3RfcmVhZF9hdBgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAYgBARIzCg9sYXN0X3dyaXR0ZW5fYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCmNyZWF0ZWRfYXQYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKCmNyZWF0ZWRfYnkYDCABKAlIAogBARI4Cg9zb2Z0X2RlbGV0ZWRfYXQYDSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wSAOIAQESNAoLcHVyZ2VfYWZ0ZXIYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wSASIAQFCDQoLX2V4cGlyZXNfYXRCDwoNX2xhc3RfcmVhZF9hdEINCgtfY3JlYXRlZF9ieUISChBfc29mdF9kZWxldGVkX2F0Qg4KDF9wdXJnZV9hZnRlciKaAgoQUHV0U2VjcmV0UmVxdWVzdBIaCgl0ZW5hbnRfaWQYASABKAlCB7pIBHICEAESGwoKcHJvamVjdF9pZBgCIAEoCUIHukgEcgIQARI1Cgpvd25lcl9raW5kGAMgASgOMhUuc2VjcmV0cy52MS5Pd25lcktpbmRCCrpIB4IBBBABIAASEAoIb3duZXJfaWQYBCABKAkSFQoEa2luZBgFIAEoCUIHukgEcgIQARINCgVsYWJlbBgGIAEoCRIaCglwbGFpbnRleHQYByABKAxCB7pIBHoCEAESMwoKZXhwaXJlc19hdBgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAIgBAUINCgtfZXhwaXJlc19hdCIgChFQdXRTZWNyZXRSZXNwb25zZRILCgNyZWYYASABKAkiOQoQR2V0U2VjcmV0UmVxdWVzdBIUCgNyZWYYASABKAlCB7pIBHICEAESDwoHcHVycG9zZRgCIAEoCSJUChFHZXRTZWNyZXRSZXNwb25zZRIRCglwbGFpbnRleHQYASABKAwSLAoIbWV0YWRhdGEYAiABKAsyGi5zZWNyZXRzLnYxLlNlY3JldE1ldGFkYXRhIrYBChJMaXN0U2VjcmV0c1JlcXVlc3QSGgoJdGVuYW50X2lkGAEgASgJQge6SARyAhABEhsKCnByb2plY3RfaWQYAiABKAlCB7pIBHICEAESKQoKb3duZXJfa2luZBgDIAEoDjIVLnNlY3JldHMudjEuT3duZXJLaW5kEhAKCG93bmVyX2lkGAQgASgJEgwKBGtpbmQYBSABKAkSHAoUaW5jbHVkZV9zb2Z0X2RlbGV0ZWQYBiABKAgiQgoTTGlzdFNlY3JldHNSZXNwb25zZRIrCgdzZWNyZXRzGAEgAygLMhouc2VjcmV0cy52MS5TZWNyZXRNZXRhZGF0YSKLAQoTUm90YXRlU2VjcmV0UmVxdWVzdBIUCgNyZWYYASABKAlCB7pIBHICEAESGgoJcGxhaW50ZXh0GAIgASgMQge6SAR6AhABEjMKCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wSACIAQFCDQoLX2V4cGlyZXNfYXQiJwoUUm90YXRlU2VjcmV0UmVzcG9uc2USDwoHbmV3X3JlZhgBIAEoCSIrChNEZWxldGVTZWNyZXRSZXF1ZXN0EhQKA3JlZhgBIAEoCUIHukgEcgIQASIWChREZWxldGVTZWNyZXRSZXNwb25zZSIsChRSZXN0b3JlU2VjcmV0UmVxdWVzdBIUCgNyZWYYASABKAlCB7pIBHICEAEiFwoVUmVzdG9yZVNlY3JldFJlc3BvbnNlIkAKF1B1cmdlU29mdERlbGV0ZWRSZXF1ZXN0EhEKCXRlbmFudF9pZBgBIAEoCRISCgpwcm9qZWN0X2lkGAIgASgJIjAKGFB1cmdlU29mdERlbGV0ZWRSZXNwb25zZRIUCgxwdXJnZWRfY291bnQYASABKAMqbAoJT3duZXJLaW5kEhoKFk9XTkVSX0tJTkRfVU5TUEVDSUZJRUQQABIWChJPV05FUl9LSU5EX1BST0pFQ1QQARISCg5PV05FUl9LSU5EX0FQUBACEhcKE09XTkVSX0tJTkRfQ1VTVE9NRVIQAzLPBAoOU2VjcmV0c1NlcnZpY2USSAoJUHV0U2VjcmV0Ehwuc2VjcmV0cy52MS5QdXRTZWNyZXRSZXF1ZXN0Gh0uc2VjcmV0cy52MS5QdXRTZWNyZXRSZXNwb25zZRJICglHZXRTZWNyZXQSHC5zZWNyZXRzLnYxLkdldFNlY3JldFJlcXVlc3QaHS5zZWNyZXRzLnYxLkdldFNlY3JldFJlc3BvbnNlEk4KC0xpc3RTZWNyZXRzEh4uc2VjcmV0cy52MS5MaXN0U2VjcmV0c1JlcXVlc3QaHy5zZWNyZXRzLnYxLkxpc3RTZWNyZXRzUmVzcG9uc2USUQoMUm90YXRlU2VjcmV0Eh8uc2VjcmV0cy52MS5Sb3RhdGVTZWNyZXRSZXF1ZXN0GiAuc2VjcmV0cy52MS5Sb3RhdGVTZWNyZXRSZXNwb25zZRJRCgxEZWxldGVTZWNyZXQSHy5zZWNyZXRzLnYxLkRlbGV0ZVNlY3JldFJlcXVlc3QaIC5zZWNyZXRzLnYxLkRlbGV0ZVNlY3JldFJlc3BvbnNlElQKDVJlc3RvcmVTZWNyZXQSIC5zZWNyZXRzLnYxLlJlc3RvcmVTZWNyZXRSZXF1ZXN0GiEuc2VjcmV0cy52MS5SZXN0b3JlU2VjcmV0UmVzcG9uc2USXQoQUHVyZ2VTb2Z0RGVsZXRlZBIjLnNlY3JldHMudjEuUHVyZ2VTb2Z0RGVsZXRlZFJlcXVlc3QaJC5zZWNyZXRzLnYxLlB1cmdlU29mdERlbGV0ZWRSZXNwb25zZUI7WjlnaXRodWIuY29tL2VpZGVzdHVkaW8vZm9pci9nZW4vcHJvdG8vc2VjcmV0cy92MTtzZWNyZXRzdjFiBnByb3RvMw", [file_buf_validate_validate, file_google_protobuf_timestamp]);
+
+/**
+ * Describes the message secrets.v1.SecretMetadata.
+ * Use `create(SecretMetadataSchema)` to create a new message.
+ */
+export const SecretMetadataSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 0);
+
+/**
+ * Describes the message secrets.v1.PutSecretRequest.
+ * Use `create(PutSecretRequestSchema)` to create a new message.
+ */
+export const PutSecretRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 1);
+
+/**
+ * Describes the message secrets.v1.PutSecretResponse.
+ * Use `create(PutSecretResponseSchema)` to create a new message.
+ */
+export const PutSecretResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 2);
+
+/**
+ * Describes the message secrets.v1.GetSecretRequest.
+ * Use `create(GetSecretRequestSchema)` to create a new message.
+ */
+export const GetSecretRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 3);
+
+/**
+ * Describes the message secrets.v1.GetSecretResponse.
+ * Use `create(GetSecretResponseSchema)` to create a new message.
+ */
+export const GetSecretResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 4);
+
+/**
+ * Describes the message secrets.v1.ListSecretsRequest.
+ * Use `create(ListSecretsRequestSchema)` to create a new message.
+ */
+export const ListSecretsRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 5);
+
+/**
+ * Describes the message secrets.v1.ListSecretsResponse.
+ * Use `create(ListSecretsResponseSchema)` to create a new message.
+ */
+export const ListSecretsResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 6);
+
+/**
+ * Describes the message secrets.v1.RotateSecretRequest.
+ * Use `create(RotateSecretRequestSchema)` to create a new message.
+ */
+export const RotateSecretRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 7);
+
+/**
+ * Describes the message secrets.v1.RotateSecretResponse.
+ * Use `create(RotateSecretResponseSchema)` to create a new message.
+ */
+export const RotateSecretResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 8);
+
+/**
+ * Describes the message secrets.v1.DeleteSecretRequest.
+ * Use `create(DeleteSecretRequestSchema)` to create a new message.
+ */
+export const DeleteSecretRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 9);
+
+/**
+ * Describes the message secrets.v1.DeleteSecretResponse.
+ * Use `create(DeleteSecretResponseSchema)` to create a new message.
+ */
+export const DeleteSecretResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 10);
+
+/**
+ * Describes the message secrets.v1.RestoreSecretRequest.
+ * Use `create(RestoreSecretRequestSchema)` to create a new message.
+ */
+export const RestoreSecretRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 11);
+
+/**
+ * Describes the message secrets.v1.RestoreSecretResponse.
+ * Use `create(RestoreSecretResponseSchema)` to create a new message.
+ */
+export const RestoreSecretResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 12);
+
+/**
+ * Describes the message secrets.v1.PurgeSoftDeletedRequest.
+ * Use `create(PurgeSoftDeletedRequestSchema)` to create a new message.
+ */
+export const PurgeSoftDeletedRequestSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 13);
+
+/**
+ * Describes the message secrets.v1.PurgeSoftDeletedResponse.
+ * Use `create(PurgeSoftDeletedResponseSchema)` to create a new message.
+ */
+export const PurgeSoftDeletedResponseSchema = /*@__PURE__*/
+  messageDesc(file_secrets_v1_secrets, 14);
+
+/**
+ * Describes the enum secrets.v1.OwnerKind.
+ */
+export const OwnerKindSchema = /*@__PURE__*/
+  enumDesc(file_secrets_v1_secrets, 0);
+
+/**
+ * OwnerKind identifies the entity that owns a secret. Tenant-wide secrets
+ * are intentionally excluded — tenants are workspaces of projects, not data
+ * containers.
+ *
+ * @generated from enum secrets.v1.OwnerKind
+ */
+export const OwnerKind = /*@__PURE__*/
+  tsEnum(OwnerKindSchema);
+
+/**
+ * @generated from service secrets.v1.SecretsService
+ */
+export const SecretsService = /*@__PURE__*/
+  serviceDesc(file_secrets_v1_secrets, 0);
+