@happyvertical/smrt-secrets 0.37.2 → 0.37.3

package/dist/chunks/SecretService-Ty8THRAf.js

@@ -1,1311 +0,0 @@
-import { a as SecretAuditLog, S as Secret, T as TenantKey, c as createAuditEntry } from "./TenantKey-Da_DXRSn.js";
-import { loadEnvConfig } from "@happyvertical/utils";
-import { getSecretStore, EnvelopeEncryption, AMKUnavailableError, TenantKeyMissingError, EncryptionError, DecryptionError } from "@happyvertical/secrets";
-import { requireTenantId, withTenant, getCurrentTenant } from "@happyvertical/smrt-tenancy";
-import { SmrtCollection } from "@happyvertical/smrt-core";
-class SecretAuditLogCollection extends SmrtCollection {
-  static _itemClass = SecretAuditLog;
-  /**
-   * List audit logs with filtering options
-   */
-  async listLogs(options = {}) {
-    const where = {};
-    if (options.tenantId) {
-      where.tenantId = options.tenantId;
-    }
-    if (options.secretName) {
-      where.secretName = options.secretName;
-    }
-    if (options.userId) {
-      where.userId = options.userId;
-    }
-    if (options.action) {
-      where.action = options.action;
-    }
-    if (options.result) {
-      where.result = options.result;
-    }
-    if (options.since) {
-      where["created_at >"] = options.since.toISOString();
-    }
-    if (options.until) {
-      where["created_at <"] = options.until.toISOString();
-    }
-    return this.list({
-      where,
-      limit: options.limit ?? 100,
-      offset: options.offset,
-      orderBy: "created_at DESC"
-    });
-  }
-  /**
-   * Get audit logs for a specific secret.
-   *
-   * @param tenantId - Scope to this tenant's audit trail, or `null` for a
-   *   cross-tenant compliance query (which must run under
-   *   `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy`). Audit rows
-   *   reference secret names and must not leak across tenants (#1503).
-   */
-  async getSecretHistory(tenantId, secretName, limit = 50) {
-    return this.listLogs({ tenantId: tenantId ?? void 0, secretName, limit });
-  }
-  /**
-   * Get audit logs for a specific user.
-   *
-   * @param tenantId - Scope to this tenant's audit trail, or `null` for a
-   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).
-   */
-  async getUserActivity(tenantId, userId, limit = 50) {
-    return this.listLogs({ tenantId: tenantId ?? void 0, userId, limit });
-  }
-  /**
-   * Get recent failures.
-   *
-   * @param tenantId - Scope to this tenant's audit trail, or `null` for a
-   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).
-   */
-  async getRecentFailures(tenantId, limit = 20) {
-    return this.listLogs({
-      tenantId: tenantId ?? void 0,
-      result: "failure",
-      limit
-    });
-  }
-  /**
-   * Get recent denied access attempts.
-   *
-   * @param tenantId - Scope to this tenant's audit trail, or `null` for a
-   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).
-   */
-  async getRecentDenials(tenantId, limit = 20) {
-    return this.listLogs({
-      tenantId: tenantId ?? void 0,
-      result: "denied",
-      limit
-    });
-  }
-  /**
-   * Count operations by action type.
-   *
-   * @param tenantId - Scope to this tenant's audit trail, or `null` for a
-   *   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).
-   */
-  async countByAction(tenantId, since) {
-    const logs = await this.listLogs({
-      tenantId: tenantId ?? void 0,
-      since,
-      limit: 1e4
-    });
-    const counts = {
-      create: 0,
-      read: 0,
-      update: 0,
-      delete: 0,
-      rotate_key: 0,
-      disable: 0,
-      enable: 0,
-      expire: 0
-    };
-    for (const log of logs) {
-      counts[log.action]++;
-    }
-    return counts;
-  }
-  /**
-   * Count operations by result.
-   *
-   * @param tenantId - Scope to this tenant's audit trail, or `null` for a
-   *   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).
-   */
-  async countByResult(tenantId, since) {
-    const logs = await this.listLogs({
-      tenantId: tenantId ?? void 0,
-      since,
-      limit: 1e4
-    });
-    const counts = {
-      success: 0,
-      failure: 0,
-      denied: 0
-    };
-    for (const log of logs) {
-      counts[log.result]++;
-    }
-    return counts;
-  }
-  /**
-   * Delete old audit logs
-   * @param olderThanDays Delete logs older than this many days
-   */
-  async cleanup(olderThanDays = 365) {
-    const cutoffDate = /* @__PURE__ */ new Date();
-    cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);
-    const oldLogs = await this.list({
-      where: {
-        "created_at <": cutoffDate.toISOString()
-      }
-    });
-    let count = 0;
-    for (const log of oldLogs) {
-      await log.delete();
-      count++;
-    }
-    return count;
-  }
-}
-class SecretCollection extends SmrtCollection {
-  static _itemClass = Secret;
-  /**
-   * Find a secret by name within the given tenant
-   */
-  async findByName(tenantId, name) {
-    return this.get({ name, tenantId });
-  }
-  /**
-   * List secrets for a tenant with filtering options
-   */
-  async listSecrets(tenantId, options = {}) {
-    const where = { tenantId };
-    if (options.category) {
-      where.category = options.category;
-    }
-    if (options.status) {
-      where.status = options.status;
-    }
-    const secrets = await this.list({
-      where,
-      limit: options.limit,
-      offset: options.offset,
-      orderBy: "name ASC"
-    });
-    if (!options.includeExpired) {
-      return secrets.filter((secret) => !secret.isExpired());
-    }
-    return secrets;
-  }
-  /**
-   * List all active secrets for a tenant
-   */
-  async listActive(tenantId) {
-    return this.listSecrets(tenantId, { status: "active" });
-  }
-  /**
-   * List a tenant's secrets by category
-   */
-  async listByCategory(tenantId, category) {
-    return this.listSecrets(tenantId, { category, status: "active" });
-  }
-  /**
-   * List a tenant's secrets that need attention (expired or about to expire)
-   */
-  async listExpiring(tenantId, daysAhead = 30) {
-    const futureDate = /* @__PURE__ */ new Date();
-    futureDate.setDate(futureDate.getDate() + daysAhead);
-    const secrets = await this.list({
-      where: {
-        tenantId,
-        status: "active",
-        "expiresAt !=": null,
-        "expiresAt <": futureDate.toISOString()
-      },
-      orderBy: "expiresAt ASC"
-    });
-    return secrets;
-  }
-  /**
-   * Get categories used in a tenant's secrets
-   */
-  async getCategories(tenantId) {
-    const secrets = await this.list({ where: { tenantId } });
-    const categories = new Set(secrets.map((s) => s.category).filter(Boolean));
-    return Array.from(categories).sort();
-  }
-  /**
-   * Count a tenant's secrets by status
-   */
-  async countByStatus(tenantId) {
-    const secrets = await this.list({ where: { tenantId } });
-    const counts = {
-      active: 0,
-      disabled: 0,
-      expired: 0
-    };
-    for (const secret of secrets) {
-      if (secret.isExpired()) {
-        counts.expired++;
-      } else {
-        counts[secret.status]++;
-      }
-    }
-    return counts;
-  }
-  /**
-   * Delete a tenant's secret by name
-   */
-  async deleteByName(tenantId, name) {
-    const secret = await this.findByName(tenantId, name);
-    if (!secret) return false;
-    await secret.delete();
-    return true;
-  }
-}
-class TenantKeyCollection extends SmrtCollection {
-  static _itemClass = TenantKey;
-  /**
-   * Get the active key for a tenant
-   */
-  async getActiveKey(tenantId) {
-    return this.get({
-      tenantId,
-      status: "active"
-    });
-  }
-  /**
-   * List all key versions for a tenant
-   */
-  async listKeyVersions(tenantId) {
-    return this.list({
-      where: { tenantId },
-      orderBy: "version DESC"
-    });
-  }
-  /**
-   * Get a specific key version for a tenant
-   */
-  async getKeyVersion(tenantId, version) {
-    return this.get({
-      tenantId,
-      version
-    });
-  }
-  /**
-   * Find keys that need rotation
-   */
-  async findKeysNeedingRotation() {
-    const now = /* @__PURE__ */ new Date();
-    return this.list({
-      where: {
-        status: "active",
-        "rotateAfter !=": null,
-        "rotateAfter <": now.toISOString()
-      },
-      orderBy: "rotateAfter ASC"
-    });
-  }
-  /**
-   * List all active keys across all tenants
-   */
-  async listAllActiveKeys() {
-    return this.list({
-      where: { status: "active" },
-      orderBy: "created_at DESC"
-    });
-  }
-  /**
-   * Count keys by status
-   */
-  async countByStatus() {
-    const keys = await this.list({});
-    const counts = {
-      active: 0,
-      rotating: 0,
-      retired: 0,
-      compromised: 0
-    };
-    for (const key of keys) {
-      counts[key.status]++;
-    }
-    return counts;
-  }
-  /**
-   * Mark a key as compromised (should trigger re-encryption)
-   */
-  async markCompromised(tenantId, keyId) {
-    const key = await this.get({
-      id: keyId,
-      tenantId
-    });
-    if (!key) return false;
-    key.markCompromised();
-    await key.save();
-    return true;
-  }
-  /**
-   * Delete old retired keys that are no longer needed
-   * @param olderThanDays Delete keys retired more than this many days ago
-   */
-  async cleanupRetiredKeys(olderThanDays = 90) {
-    const cutoffDate = /* @__PURE__ */ new Date();
-    cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);
-    const oldKeys = await this.list({
-      where: {
-        status: "retired",
-        "retiredAt <": cutoffDate.toISOString()
-      }
-    });
-    let count = 0;
-    for (const key of oldKeys) {
-      await key.delete();
-      count++;
-    }
-    return count;
-  }
-}
-class ConsoleLogger {
-  constructor(level = "info") {
-    this.level = level;
-  }
-  static LEVELS = [
-    "debug",
-    "info",
-    "warn",
-    "error"
-  ];
-  /**
-   * Check if a log level should be output
-   *
-   * @param level - Log level to check
-   * @returns True if level meets threshold
-   */
-  shouldLog(level) {
-    const currentIndex = ConsoleLogger.LEVELS.indexOf(this.level);
-    const messageIndex = ConsoleLogger.LEVELS.indexOf(level);
-    return messageIndex >= currentIndex;
-  }
-  /**
-   * Format context for console output
-   *
-   * @param context - Structured metadata
-   * @returns Formatted context string
-   */
-  formatContext(context) {
-    if (!context || Object.keys(context).length === 0) {
-      return "";
-    }
-    return ` ${JSON.stringify(context)}`;
-  }
-  debug(message, context) {
-    if (this.shouldLog("debug")) {
-      console.debug(`[DEBUG] ${message}${this.formatContext(context)}`);
-    }
-  }
-  info(message, context) {
-    if (this.shouldLog("info")) {
-      console.info(`[INFO] ${message}${this.formatContext(context)}`);
-    }
-  }
-  warn(message, context) {
-    if (this.shouldLog("warn")) {
-      console.warn(`[WARN] ${message}${this.formatContext(context)}`);
-    }
-  }
-  error(message, context) {
-    if (this.shouldLog("error")) {
-      console.error(`[ERROR] ${message}${this.formatContext(context)}`);
-    }
-  }
-}
-class NoopLogger {
-  debug(_message, _context) {
-  }
-  info(_message, _context) {
-  }
-  warn(_message, _context) {
-  }
-  error(_message, _context) {
-  }
-}
-function createLogger(config) {
-  if (typeof config === "boolean") {
-    if (!config) {
-      return new NoopLogger();
-    }
-    const envConfig = loadEnvConfig(
-      {},
-      {
-        packageName: "logger",
-        schema: { level: "string" }
-      }
-    );
-    return new ConsoleLogger(envConfig.level || "info");
-  }
-  const mergedConfig = loadEnvConfig(config, {
-    packageName: "logger",
-    schema: { level: "string" }
-  });
-  const level = mergedConfig.level || "info";
-  return new ConsoleLogger(level);
-}
-const logger = createLogger({ level: "info" });
-class SecretKeyDriftError extends Error {
-  code = "SECRET_KEY_DRIFT";
-  tenantId;
-  report;
-  cause;
-  constructor(message, tenantId, report, cause) {
-    super(message);
-    this.name = "SecretKeyDriftError";
-    this.tenantId = tenantId;
-    this.report = report;
-    this.cause = cause;
-  }
-}
-class SecretService {
-  db;
-  secretStore;
-  secrets;
-  tenantKeys;
-  auditLogs;
-  auditEnabled;
-  amkEnvVar;
-  amkKeyId;
-  constructor(db, secretStore, secrets, tenantKeys, auditLogs, auditEnabled, amkEnvVar, amkKeyId) {
-    this.db = db;
-    this.secretStore = secretStore;
-    this.secrets = secrets;
-    this.tenantKeys = tenantKeys;
-    this.auditLogs = auditLogs;
-    this.auditEnabled = auditEnabled;
-    this.amkEnvVar = amkEnvVar;
-    this.amkKeyId = amkKeyId;
-  }
-  /**
-   * Create a new SecretService instance
-   */
-  static async create(options) {
-    const {
-      db,
-      amkEnvVar = "SMRT_SECRET_MASTER_KEY",
-      amkKeyId = "smrt-amk-v1",
-      auditEnabled = true
-    } = options;
-    const secretStore = await getSecretStore({
-      type: "database",
-      db,
-      amk: {
-        provider: "env",
-        keyEnvVar: amkEnvVar,
-        keyId: amkKeyId
-      }
-    });
-    const baseOptions = { db };
-    const secrets = await SecretCollection.create(baseOptions);
-    const tenantKeys = await TenantKeyCollection.create(baseOptions);
-    const auditLogs = await SecretAuditLogCollection.create(baseOptions);
-    return new SecretService(
-      db,
-      secretStore,
-      secrets,
-      tenantKeys,
-      auditLogs,
-      auditEnabled,
-      amkEnvVar,
-      amkKeyId
-    );
-  }
-  /**
-   * Store a secret for the current tenant
-   */
-  async store(name, value, options = {}) {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    let isUpdate = false;
-    try {
-      let existing = await this.secrets.findByName(tenantId, name);
-      if (existing && existing.tenantId !== tenantId) {
-        existing = null;
-      }
-      isUpdate = existing !== null;
-      const envelope = await this.secretStore.encrypt(tenantId, name, value, {
-        metadata: options.metadata ? this.serializeMetadata(options.metadata) : void 0
-      });
-      if (existing) {
-        existing.encryptedValue = JSON.stringify(envelope);
-        existing.description = options.description ?? existing.description;
-        existing.category = options.category ?? existing.category;
-        existing.expiresAt = options.expiresAt ?? existing.expiresAt;
-        existing.metadata = options.metadata ?? existing.metadata;
-        await existing.save();
-        await this.audit(
-          existing.id ?? null,
-          name,
-          userId,
-          "update",
-          "success"
-        );
-        return existing;
-      }
-      const secret = await this.secrets.create({
-        name,
-        description: options.description ?? "",
-        category: options.category ?? "",
-        encryptedValue: JSON.stringify(envelope),
-        keyVersion: 1,
-        status: "active",
-        expiresAt: options.expiresAt ?? null,
-        metadata: options.metadata ?? {},
-        context: tenantId,
-        // Per-tenant uniqueness
-        tenantId
-      });
-      await this.audit(secret.id ?? null, name, userId, "create", "success");
-      return secret;
-    } catch (error) {
-      const classifiedError = await this.classifyTenantKeyFailure(
-        tenantId,
-        name,
-        error
-      );
-      await this.audit(
-        null,
-        name,
-        userId,
-        isUpdate ? "update" : "create",
-        "failure",
-        {
-          error: classifiedError.message
-        }
-      );
-      throw classifiedError;
-    }
-  }
-  /**
-   * Store a secret for a specific tenant.
-   *
-   * This is useful for integrations that already resolved tenant ownership but
-   * may be running outside the application's ambient tenant context.
-   */
-  async storeForTenant(tenantId, name, value, options = {}) {
-    return withTenant({ tenantId }, () => this.store(name, value, options));
-  }
-  /**
-   * Retrieve a secret for the current tenant
-   */
-  async retrieve(name) {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    let audited = false;
-    try {
-      const secret = await this.secrets.findByName(tenantId, name);
-      if (!secret || secret.tenantId !== tenantId) {
-        await this.audit(null, name, userId, "read", "failure", {
-          error: "Secret not found"
-        });
-        audited = true;
-        throw new Error(`Secret '${name}' not found`);
-      }
-      if (!secret.isUsable()) {
-        const reason = secret.isExpired() ? "Secret expired" : "Secret disabled";
-        await this.audit(secret.id ?? null, name, userId, "read", "failure", {
-          error: reason
-        });
-        audited = true;
-        throw new Error(reason);
-      }
-      const envelope = JSON.parse(secret.encryptedValue);
-      const decrypted = await this.secretStore.decrypt(tenantId, envelope);
-      const previousLastAccessedAt = secret.lastAccessedAt;
-      const previousAccessCount = secret.accessCount;
-      try {
-        secret.recordAccess();
-        await secret.save();
-      } catch (trackingError) {
-        secret.lastAccessedAt = previousLastAccessedAt;
-        secret.accessCount = previousAccessCount;
-        logger.error("Failed to update secret access tracking", {
-          error: trackingError
-        });
-      }
-      await this.audit(secret.id ?? null, name, userId, "read", "success");
-      return {
-        value: decrypted.value,
-        name: secret.name,
-        description: secret.description,
-        category: secret.category,
-        expiresAt: secret.expiresAt,
-        createdAt: secret.created_at ?? /* @__PURE__ */ new Date(),
-        lastAccessedAt: secret.lastAccessedAt,
-        accessCount: secret.accessCount,
-        metadata: secret.metadata
-      };
-    } catch (error) {
-      const classifiedError = await this.classifyTenantKeyFailure(
-        tenantId,
-        name,
-        error
-      );
-      if (!audited) {
-        await this.audit(null, name, userId, "read", "failure", {
-          error: classifiedError.message
-        });
-      }
-      throw classifiedError;
-    }
-  }
-  /**
-   * Retrieve a secret for a specific tenant.
-   */
-  async retrieveForTenant(tenantId, name) {
-    return withTenant({ tenantId }, () => this.retrieve(name));
-  }
-  /**
-   * Diagnose tenant secret/key drift without exposing decrypted values.
-   */
-  async diagnoseTenantSecretKeyDrift(tenantId, options = {}) {
-    const activeSecrets = await this.listActiveSecretRowsForDiagnosis(
-      tenantId,
-      options.secretNames
-    );
-    const tenantEncryptionKeys = await this.listTenantEncryptionKeyRows(tenantId);
-    const smrtTenantKeyRows = await this.listSmrtTenantKeysForDiagnosis(tenantId);
-    const smrtTenantKeys = smrtTenantKeyRows.keys;
-    const issues = [];
-    const activeTenantEncryptionKeys = tenantEncryptionKeys.filter(
-      (key) => key.status === "active"
-    );
-    const activeSmrtTenantKeys = smrtTenantKeys.filter(
-      (key) => key.status === "active"
-    );
-    const amk = this.getConfiguredAmkForDiagnosis();
-    if (!amk.usable) {
-      issues.push({
-        code: "amk_unavailable",
-        severity: "error",
-        message: amk.error ?? `AMK ${this.amkEnvVar} is unavailable`,
-        repairAction: "none",
-        details: {
-          amkEnvVar: this.amkEnvVar,
-          amkKeyId: this.amkKeyId
-        }
-      });
-    }
-    if (activeSecrets.length > 0 && activeTenantEncryptionKeys.length === 0) {
-      issues.push({
-        code: "missing_active_tenant_encryption_key",
-        severity: "error",
-        message: "Active tenant secrets exist, but tenant_encryption_keys has no active key for encryption.",
-        repairAction: "store-fresh-secret-value",
-        sourceTable: "tenant_encryption_keys",
-        details: {
-          activeSecretCount: activeSecrets.length
-        }
-      });
-    }
-    if (smrtTenantKeyRows.error) {
-      issues.push({
-        code: "smrt_tenant_keys_query_failed",
-        severity: "error",
-        message: "Unable to query SMRT tenant_keys while diagnosing tenant secret key drift.",
-        repairAction: "none",
-        sourceTable: "tenant_keys",
-        details: {
-          error: smrtTenantKeyRows.error.message
-        }
-      });
-    }
-    if (activeTenantEncryptionKeys.length > 1) {
-      issues.push({
-        code: "multiple_active_tenant_encryption_keys",
-        severity: "error",
-        message: "tenant_encryption_keys has multiple active keys for this tenant; encryption may use an arbitrary active key.",
-        repairAction: "none",
-        sourceTable: "tenant_encryption_keys",
-        details: {
-          activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length
-        }
-      });
-    }
-    const activeKeyChecks = [];
-    for (const key of tenantEncryptionKeys) {
-      const check = amk.value ? this.checkWrappedKey(key.wrapped_key, amk.value) : { usable: false, error: amk.error };
-      if (key.status === "active") {
-        activeKeyChecks.push(check);
-      }
-      if (key.status === "active" && key.amk_key_id !== this.amkKeyId) {
-        issues.push({
-          code: "active_tenant_encryption_key_amk_mismatch",
-          severity: "warning",
-          message: "Active tenant_encryption_keys row was wrapped by a different AMK key id than this SecretService is configured to use.",
-          repairAction: "none",
-          keyId: key.id,
-          sourceTable: "tenant_encryption_keys",
-          details: {
-            rowAmkKeyId: key.amk_key_id,
-            configuredAmkKeyId: this.amkKeyId
-          }
-        });
-      }
-      if (key.status === "active" && !check.usable && amk.value) {
-        issues.push({
-          code: "active_tenant_encryption_key_unwrap_failed",
-          severity: "error",
-          message: "Active tenant_encryption_keys row cannot be unwrapped by the currently configured AMK.",
-          repairAction: "delete-unusable-tenant-encryption-key",
-          keyId: key.id,
-          sourceTable: "tenant_encryption_keys",
-          details: {
-            version: key.version,
-            error: check.error ?? null
-          }
-        });
-      }
-    }
-    const usableActiveTenantEncryptionKeyCount = activeKeyChecks.filter(
-      (check) => check.usable
-    ).length;
-    if (activeSecrets.length > 0 && usableActiveTenantEncryptionKeyCount === 0) {
-      issues.push({
-        code: "active_secrets_without_usable_active_key",
-        severity: "error",
-        message: "Active secrets exist, but no active tenant_encryption_keys row can be used with the current AMK.",
-        repairAction: "store-fresh-secret-value",
-        sourceTable: "tenant_encryption_keys",
-        details: {
-          activeSecretCount: activeSecrets.length,
-          activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length
-        }
-      });
-    }
-    const keyFingerprintToRow = /* @__PURE__ */ new Map();
-    for (const key of tenantEncryptionKeys) {
-      const fingerprint = this.getWrappedKeyFingerprint(key.wrapped_key);
-      if (fingerprint) {
-        keyFingerprintToRow.set(fingerprint, key);
-      }
-    }
-    for (const secret of activeSecrets) {
-      const envelope = this.parseSecretEnvelopeForDiagnosis(secret, issues);
-      if (!envelope) continue;
-      const envelopeFingerprint = this.getWrappedKeyFingerprint(
-        envelope.wrappedKey
-      );
-      const envelopeCheck = amk.value ? this.checkWrappedKey(envelope.wrappedKey, amk.value) : {
-        usable: false,
-        error: amk.error,
-        fingerprint: envelopeFingerprint
-      };
-      if (!envelopeCheck.fingerprint) {
-        issues.push({
-          code: "secret_envelope_invalid_wrapped_key",
-          severity: "error",
-          message: "Secret encryptedValue contains an invalid wrapped key format.",
-          repairAction: "delete-unrecoverable-secret",
-          secretId: secret.id,
-          secretName: secret.name,
-          sourceTable: "secrets",
-          details: {
-            error: envelopeCheck.error ?? null
-          }
-        });
-        continue;
-      }
-      const matchingKey = keyFingerprintToRow.get(envelopeCheck.fingerprint);
-      if (!matchingKey) {
-        issues.push({
-          code: "secret_envelope_missing_tenant_encryption_key",
-          severity: "error",
-          message: "Secret envelope does not match any tenant_encryption_keys row for this tenant.",
-          repairAction: !amk.value ? "none" : envelopeCheck.usable ? "none" : "delete-unrecoverable-secret",
-          secretId: secret.id,
-          secretName: secret.name,
-          sourceTable: "secrets"
-        });
-      }
-      if (!envelopeCheck.usable && amk.value) {
-        issues.push({
-          code: "secret_envelope_unwrap_failed",
-          severity: "error",
-          message: "Secret envelope cannot be unwrapped by the currently configured AMK.",
-          repairAction: "delete-unrecoverable-secret",
-          secretId: secret.id,
-          secretName: secret.name,
-          keyId: matchingKey?.id,
-          sourceTable: "secrets",
-          details: {
-            error: envelopeCheck.error ?? null
-          }
-        });
-      }
-    }
-    if (activeSecrets.length > 0 && tenantEncryptionKeys.length > 0 && smrtTenantKeys.length === 0 && !smrtTenantKeyRows.error) {
-      issues.push({
-        code: "smrt_tenant_keys_not_mirrored",
-        severity: "info",
-        message: "SMRT tenant_keys has no rows for this tenant, while the lower-level tenant_encryption_keys table does. SecretService uses tenant_encryption_keys for encryption.",
-        repairAction: "none",
-        sourceTable: "tenant_keys"
-      });
-    }
-    return {
-      tenantId,
-      checkedAt: /* @__PURE__ */ new Date(),
-      ok: !issues.some((issue) => issue.severity === "error"),
-      summary: {
-        activeSecretCount: activeSecrets.length,
-        tenantEncryptionKeyCount: tenantEncryptionKeys.length,
-        activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,
-        usableActiveTenantEncryptionKeyCount,
-        smrtTenantKeyCount: smrtTenantKeys.length,
-        activeSmrtTenantKeyCount: activeSmrtTenantKeys.length
-      },
-      issues
-    };
-  }
-  /**
-   * Diagnose drift for the current tenant context.
-   */
-  async diagnoseCurrentTenantSecretKeyDrift(options = {}) {
-    return this.diagnoseTenantSecretKeyDrift(requireTenantId(), options);
-  }
-  /**
-   * Delete unrecoverable secret/key rows identified by diagnosis.
-   *
-   * This never attempts to recover or expose secret values. Use dryRun first
-   * to preview destructive changes.
-   */
-  async repairTenantSecretKeyDrift(tenantId, options = {}) {
-    const dryRun = options.dryRun ?? false;
-    const before = await this.diagnoseTenantSecretKeyDrift(tenantId, options);
-    const secretIds = /* @__PURE__ */ new Set();
-    const secretNames = /* @__PURE__ */ new Map();
-    const tenantEncryptionKeyIds = /* @__PURE__ */ new Set();
-    for (const issue of before.issues) {
-      if (issue.repairAction === "delete-unrecoverable-secret" && issue.secretId) {
-        secretIds.add(issue.secretId);
-        if (issue.secretName) {
-          secretNames.set(issue.secretId, issue.secretName);
-        }
-      }
-      if (issue.repairAction === "delete-unusable-tenant-encryption-key" && issue.keyId) {
-        tenantEncryptionKeyIds.add(issue.keyId);
-      }
-    }
-    const wouldDeleteSecrets = secretIds.size;
-    const wouldDeleteTenantEncryptionKeys = tenantEncryptionKeyIds.size;
-    const wouldDeleteUnrecoverableData = wouldDeleteSecrets + wouldDeleteTenantEncryptionKeys > 0;
-    if (!dryRun && wouldDeleteUnrecoverableData && !options.confirmDeleteUnrecoverableData) {
-      throw new Error(
-        "repairTenantSecretKeyDrift requires confirmDeleteUnrecoverableData: true before deleting encrypted secrets or tenant key rows."
-      );
-    }
-    let deletedSecrets = 0;
-    let deletedTenantEncryptionKeys = 0;
-    if (!dryRun) {
-      const runDeletes = async (db) => {
-        const deletedSecretRows = await this.deleteRowsByIds(
-          "secrets",
-          tenantId,
-          secretIds,
-          db
-        );
-        const deletedTenantEncryptionKeyRows = await this.deleteRowsByIds(
-          "tenant_encryption_keys",
-          tenantId,
-          tenantEncryptionKeyIds,
-          db
-        );
-        return {
-          deletedSecrets: deletedSecretRows,
-          deletedTenantEncryptionKeys: deletedTenantEncryptionKeyRows
-        };
-      };
-      const txDb = this.db;
-      const deleteResult = typeof txDb.transaction === "function" ? await txDb.transaction((db) => runDeletes(db)) : await runDeletes(this.db);
-      deletedSecrets = deleteResult.deletedSecrets;
-      deletedTenantEncryptionKeys = deleteResult.deletedTenantEncryptionKeys;
-      await this.auditSecretDriftRepairDeletes(
-        tenantId,
-        secretIds,
-        secretNames
-      );
-    }
-    const after = dryRun ? before : await this.diagnoseTenantSecretKeyDrift(tenantId, options);
-    return {
-      tenantId,
-      dryRun,
-      issuesBefore: before.issues,
-      remainingIssues: after.issues,
-      wouldDeleteSecrets,
-      wouldDeleteTenantEncryptionKeys,
-      deletedSecrets,
-      deletedTenantEncryptionKeys,
-      secretNames: Array.from(secretNames.values()).sort(),
-      tenantEncryptionKeyIds: Array.from(tenantEncryptionKeyIds).sort()
-    };
-  }
-  /**
-   * List secrets for the current tenant (names only, not values)
-   */
-  async list(options = {}) {
-    return this.secrets.listSecrets(requireTenantId(), {
-      category: options.category,
-      status: "active"
-    });
-  }
-  /**
-   * Delete a secret
-   */
-  async delete(name) {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    const secret = await this.secrets.findByName(tenantId, name);
-    if (!secret || secret.tenantId !== tenantId) {
-      return false;
-    }
-    try {
-      await secret.delete();
-      await this.audit(secret.id ?? null, name, userId, "delete", "success");
-      return true;
-    } catch (error) {
-      await this.audit(secret.id ?? null, name, userId, "delete", "failure", {
-        error: error.message
-      });
-      throw error;
-    }
-  }
-  /**
-   * Disable a secret (soft delete)
-   */
-  async disable(name) {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    const secret = await this.secrets.findByName(tenantId, name);
-    if (!secret || secret.tenantId !== tenantId) {
-      return false;
-    }
-    secret.disable();
-    await secret.save();
-    await this.audit(secret.id ?? null, name, userId, "disable", "success");
-    return true;
-  }
-  /**
-   * Enable a disabled secret
-   */
-  async enable(name) {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    const secret = await this.secrets.findByName(tenantId, name);
-    if (!secret || secret.tenantId !== tenantId) {
-      return false;
-    }
-    secret.enable();
-    await secret.save();
-    await this.audit(secret.id ?? null, name, userId, "enable", "success");
-    return true;
-  }
-  /**
-   * Rotate the tenant's encryption key
-   *
-   * This creates a new TDEK and marks the old one as retired.
-   * Existing secrets remain encrypted with the old key and can still
-   * be decrypted (the old key is kept in retired state).
-   *
-   * For full re-encryption, call reencryptAll() after rotation.
-   */
-  async rotateKey() {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    try {
-      await this.secretStore.rotateTenantKey(tenantId);
-      await this.audit(null, "", userId, "rotate_key", "success", {
-        tenantId
-      });
-    } catch (error) {
-      await this.audit(null, "", userId, "rotate_key", "failure", {
-        tenantId,
-        error: error.message
-      });
-      throw error;
-    }
-  }
-  /**
-   * Re-encrypt all secrets with the current active key
-   *
-   * Call this after key rotation to ensure all secrets use the new key.
-   * This is optional but recommended for security.
-   */
-  async reencryptAll() {
-    const tenantId = requireTenantId();
-    const userId = this.getCurrentUserId();
-    const secrets = await this.secrets.list({ where: { tenantId } });
-    let success = 0;
-    let failed = 0;
-    for (const secret of secrets) {
-      try {
-        const envelope = JSON.parse(secret.encryptedValue);
-        const decrypted = await this.secretStore.decrypt(tenantId, envelope);
-        const newEnvelope = await this.secretStore.encrypt(
-          tenantId,
-          secret.name,
-          decrypted.value
-        );
-        secret.encryptedValue = JSON.stringify(newEnvelope);
-        await secret.save();
-        success++;
-      } catch (error) {
-        failed++;
-        await this.audit(
-          secret.id ?? null,
-          secret.name,
-          userId,
-          "update",
-          "failure",
-          {
-            action: "reencrypt",
-            error: error.message
-          }
-        );
-      }
-    }
-    return { success, failed };
-  }
-  /**
-   * Get audit logs for the current tenant
-   */
-  async getAuditLogs(options = {}) {
-    return this.auditLogs.listLogs({
-      // Scope to the current tenant (issue #1501): audit logs reference
-      // secret names and must not leak across tenants.
-      tenantId: requireTenantId(),
-      secretName: options.secretName,
-      limit: options.limit ?? 100
-    });
-  }
-  /**
-   * Get secret categories for the current tenant
-   */
-  async getCategories() {
-    return this.secrets.getCategories(requireTenantId());
-  }
-  /**
-   * Check if a secret exists for the current tenant
-   */
-  async exists(name) {
-    const tenantId = requireTenantId();
-    const secret = await this.secrets.findByName(tenantId, name);
-    return secret !== null && secret.tenantId === tenantId;
-  }
-  // Private methods
-  async listActiveSecretRowsForDiagnosis(tenantId, secretNames) {
-    const params = [tenantId];
-    let nameFilter = "";
-    if (secretNames && secretNames.length > 0) {
-      const placeholders = secretNames.map(() => "?").join(", ");
-      nameFilter = ` AND name IN (${placeholders})`;
-      params.push(...secretNames);
-    }
-    const result = await this.db.query(
-      `
-        SELECT id, name, encrypted_value, status, tenant_id
-        FROM "secrets"
-        WHERE tenant_id = ? AND status = 'active'${nameFilter}
-        ORDER BY name ASC
-      `,
-      ...params
-    );
-    return this.rowsFromResult(result);
-  }
-  async listTenantEncryptionKeyRows(tenantId) {
-    const result = await this.db.query(
-      `
-        SELECT id, tenant_id, wrapped_key, amk_key_id, status, version,
-          rotate_after, retired_at, created_at, updated_at
-        FROM "tenant_encryption_keys"
-        WHERE tenant_id = ?
-        ORDER BY version DESC
-      `,
-      tenantId
-    );
-    return this.rowsFromResult(result);
-  }
-  async listSmrtTenantKeysForDiagnosis(tenantId) {
-    try {
-      return { keys: await this.tenantKeys.listKeyVersions(tenantId) };
-    } catch (error) {
-      return { keys: [], error: this.toError(error) };
-    }
-  }
-  getConfiguredAmkForDiagnosis() {
-    const keyHex = process.env[this.amkEnvVar];
-    if (!keyHex) {
-      return {
-        usable: false,
-        error: `Application Master Key not found in environment variable: ${this.amkEnvVar}`
-      };
-    }
-    try {
-      return {
-        usable: true,
-        value: EnvelopeEncryption.parseHexKey(keyHex)
-      };
-    } catch (error) {
-      return {
-        usable: false,
-        error: `Invalid AMK in ${this.amkEnvVar}: ${this.toError(error).message}`
-      };
-    }
-  }
-  checkWrappedKey(wrappedKey, amk) {
-    const fingerprint = this.getWrappedKeyFingerprint(wrappedKey);
-    try {
-      const parsed = EnvelopeEncryption.parseWrappedKey(wrappedKey);
-      const dataKey = EnvelopeEncryption.unwrapKey(
-        parsed.wrappedKey,
-        parsed.iv,
-        parsed.authTag,
-        amk
-      );
-      dataKey.fill(0);
-      return { usable: true, fingerprint };
-    } catch (error) {
-      return {
-        usable: false,
-        fingerprint,
-        error: this.toError(error).message
-      };
-    }
-  }
-  getWrappedKeyFingerprint(wrappedKey) {
-    try {
-      return EnvelopeEncryption.parseWrappedKey(wrappedKey).wrappedKey;
-    } catch {
-      return void 0;
-    }
-  }
-  parseSecretEnvelopeForDiagnosis(secret, issues) {
-    try {
-      return JSON.parse(secret.encrypted_value);
-    } catch (error) {
-      issues.push({
-        code: "secret_envelope_invalid_json",
-        severity: "error",
-        message: "Secret encryptedValue is not valid EncryptedEnvelope JSON.",
-        repairAction: "delete-unrecoverable-secret",
-        secretId: secret.id,
-        secretName: secret.name,
-        sourceTable: "secrets",
-        details: {
-          error: this.toError(error).message
-        }
-      });
-      return null;
-    }
-  }
-  async deleteRowsByIds(tableName, tenantId, ids, db = this.db) {
-    if (ids.size === 0) return 0;
-    const idList = Array.from(ids);
-    const placeholders = idList.map(() => "?").join(", ");
-    const result = await db.query(
-      `DELETE FROM "${tableName}" WHERE tenant_id = ? AND id IN (${placeholders})`,
-      tenantId,
-      ...idList
-    );
-    return typeof result.rowCount === "number" ? result.rowCount : idList.length;
-  }
-  async auditSecretDriftRepairDeletes(tenantId, secretIds, secretNames) {
-    if (secretIds.size === 0) return;
-    const userId = this.getCurrentUserId();
-    await withTenant({ tenantId }, async () => {
-      for (const secretId of secretIds) {
-        await this.audit(
-          secretId,
-          secretNames.get(secretId) ?? "",
-          userId,
-          "delete",
-          "success",
-          {
-            action: "repairTenantSecretKeyDrift",
-            reason: "unrecoverable-secret-key-drift"
-          }
-        );
-      }
-    });
-  }
-  rowsFromResult(result) {
-    if (Array.isArray(result)) return result;
-    if (result && typeof result === "object" && Array.isArray(result.rows)) {
-      return result.rows;
-    }
-    return [];
-  }
-  async classifyTenantKeyFailure(tenantId, secretName, error) {
-    const normalized = this.toError(error);
-    if (!this.shouldClassifyTenantKeyFailure(normalized)) {
-      return normalized;
-    }
-    try {
-      const report = await this.diagnoseTenantSecretKeyDrift(tenantId, {
-        secretNames: [secretName]
-      });
-      const errorCodes = report.issues.filter((issue) => issue.severity === "error").map((issue) => issue.code);
-      if (errorCodes.length === 0) {
-        return normalized;
-      }
-      return new SecretKeyDriftError(
-        `Secret '${secretName}' for tenant '${tenantId}' failed because secret key drift was detected: ${[
-          ...new Set(errorCodes)
-        ].join(
-          ", "
-        )}. Run diagnoseTenantSecretKeyDrift() for details and repairTenantSecretKeyDrift() for explicit cleanup of unrecoverable rows.`,
-        tenantId,
-        report,
-        normalized
-      );
-    } catch {
-      return normalized;
-    }
-  }
-  shouldClassifyTenantKeyFailure(error) {
-    const code = this.getSecretErrorCode(error);
-    if (error instanceof AMKUnavailableError || code === "AMK_UNAVAILABLE") {
-      return false;
-    }
-    return error instanceof TenantKeyMissingError || error instanceof EncryptionError || error instanceof DecryptionError || code === "TENANT_KEY_MISSING" || code === "ENCRYPTION_FAILED" || code === "DECRYPTION_FAILED";
-  }
-  getSecretErrorCode(error) {
-    const code = error.code;
-    return typeof code === "string" ? code : void 0;
-  }
-  toError(error) {
-    return error instanceof Error ? error : new Error(String(error));
-  }
-  getCurrentUserId() {
-    const ctx = getCurrentTenant();
-    return ctx?.userId ?? "system";
-  }
-  async audit(secretId, secretName, userId, action, result, details) {
-    if (!this.auditEnabled) return;
-    try {
-      const tenantId = getCurrentTenant()?.tenantId ?? null;
-      const log = await this.auditLogs.create(
-        createAuditEntry({
-          secretId,
-          secretName,
-          userId,
-          action,
-          result,
-          details,
-          tenantId
-        })
-      );
-      await log.save();
-    } catch (error) {
-      logger.error("Failed to write audit log", { error });
-    }
-  }
-  serializeMetadata(metadata) {
-    const result = {};
-    for (const [key, value] of Object.entries(metadata)) {
-      result[key] = typeof value === "string" ? value : JSON.stringify(value);
-    }
-    return result;
-  }
-}
-export {
-  SecretAuditLogCollection as S,
-  TenantKeyCollection as T,
-  SecretCollection as a,
-  SecretKeyDriftError as b,
-  SecretService as c
-};
-//# sourceMappingURL=SecretService-Ty8THRAf.js.map