@happyvertical/smrt-secrets 0.37.2 → 0.37.4

package/dist/chunks/SecretService-DL05eyeI.js

@@ -0,0 +1,1141 @@
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./TenantKey-Dvz3zbCm.js";
+import { SmrtCollection } from "@happyvertical/smrt-core";
+import { AMKUnavailableError, DecryptionError, EncryptionError, EnvelopeEncryption, TenantKeyMissingError, getSecretStore } from "@happyvertical/secrets";
+import { loadEnvConfig } from "@happyvertical/utils";
+import { getCurrentTenant, requireTenantId, withTenant } from "@happyvertical/smrt-tenancy";
+//#region src/collections/SecretAuditLogCollection.ts
+/**
+* SecretAuditLogCollection - Collection manager for SecretAuditLog objects
+* @packageDocumentation
+*/
+/**
+* Collection for managing SecretAuditLog objects
+*/
+var SecretAuditLogCollection = class extends SmrtCollection {
+	static _itemClass = SecretAuditLog;
+	/**
+	* List audit logs with filtering options
+	*/
+	async listLogs(options = {}) {
+		const where = {};
+		if (options.tenantId) where.tenantId = options.tenantId;
+		if (options.secretName) where.secretName = options.secretName;
+		if (options.userId) where.userId = options.userId;
+		if (options.action) where.action = options.action;
+		if (options.result) where.result = options.result;
+		if (options.since) where["created_at >"] = options.since.toISOString();
+		if (options.until) where["created_at <"] = options.until.toISOString();
+		return this.list({
+			where,
+			limit: options.limit ?? 100,
+			offset: options.offset,
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Get audit logs for a specific secret.
+	*
+	* @param tenantId - Scope to this tenant's audit trail, or `null` for a
+	*   cross-tenant compliance query (which must run under
+	*   `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy`). Audit rows
+	*   reference secret names and must not leak across tenants (#1503).
+	*/
+	async getSecretHistory(tenantId, secretName, limit = 50) {
+		return this.listLogs({
+			tenantId: tenantId ?? void 0,
+			secretName,
+			limit
+		});
+	}
+	/**
+	* Get audit logs for a specific user.
+	*
+	* @param tenantId - Scope to this tenant's audit trail, or `null` for a
+	*   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).
+	*/
+	async getUserActivity(tenantId, userId, limit = 50) {
+		return this.listLogs({
+			tenantId: tenantId ?? void 0,
+			userId,
+			limit
+		});
+	}
+	/**
+	* Get recent failures.
+	*
+	* @param tenantId - Scope to this tenant's audit trail, or `null` for a
+	*   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).
+	*/
+	async getRecentFailures(tenantId, limit = 20) {
+		return this.listLogs({
+			tenantId: tenantId ?? void 0,
+			result: "failure",
+			limit
+		});
+	}
+	/**
+	* Get recent denied access attempts.
+	*
+	* @param tenantId - Scope to this tenant's audit trail, or `null` for a
+	*   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).
+	*/
+	async getRecentDenials(tenantId, limit = 20) {
+		return this.listLogs({
+			tenantId: tenantId ?? void 0,
+			result: "denied",
+			limit
+		});
+	}
+	/**
+	* Count operations by action type.
+	*
+	* @param tenantId - Scope to this tenant's audit trail, or `null` for a
+	*   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).
+	*/
+	async countByAction(tenantId, since) {
+		const logs = await this.listLogs({
+			tenantId: tenantId ?? void 0,
+			since,
+			limit: 1e4
+		});
+		const counts = {
+			create: 0,
+			read: 0,
+			update: 0,
+			delete: 0,
+			rotate_key: 0,
+			disable: 0,
+			enable: 0,
+			expire: 0
+		};
+		for (const log of logs) counts[log.action]++;
+		return counts;
+	}
+	/**
+	* Count operations by result.
+	*
+	* @param tenantId - Scope to this tenant's audit trail, or `null` for a
+	*   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).
+	*/
+	async countByResult(tenantId, since) {
+		const logs = await this.listLogs({
+			tenantId: tenantId ?? void 0,
+			since,
+			limit: 1e4
+		});
+		const counts = {
+			success: 0,
+			failure: 0,
+			denied: 0
+		};
+		for (const log of logs) counts[log.result]++;
+		return counts;
+	}
+	/**
+	* Delete old audit logs
+	* @param olderThanDays Delete logs older than this many days
+	*/
+	async cleanup(olderThanDays = 365) {
+		const cutoffDate = /* @__PURE__ */ new Date();
+		cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);
+		const oldLogs = await this.list({ where: { "created_at <": cutoffDate.toISOString() } });
+		let count = 0;
+		for (const log of oldLogs) {
+			await log.delete();
+			count++;
+		}
+		return count;
+	}
+};
+//#endregion
+//#region src/collections/SecretCollection.ts
+/**
+* SecretCollection - Collection manager for Secret objects
+* @packageDocumentation
+*/
+/**
+* Collection for managing Secret objects
+*
+* All lookups take an explicit `tenantId` and scope on the authoritative
+* `tenant_id` column. Scoping must NOT rely on the tenancy interceptor
+* (which may be disabled in the host application) and must NOT use the
+* `context` column: `context = tenantId` is only a convention applied on
+* the create path, so pre-convention rows may have a divergent `context`.
+* See https://github.com/happyvertical/smrt/issues/1501
+*/
+var SecretCollection = class extends SmrtCollection {
+	static _itemClass = Secret;
+	/**
+	* Find a secret by name within the given tenant
+	*/
+	async findByName(tenantId, name) {
+		return this.get({
+			name,
+			tenantId
+		});
+	}
+	/**
+	* List secrets for a tenant with filtering options
+	*/
+	async listSecrets(tenantId, options = {}) {
+		const where = { tenantId };
+		if (options.category) where.category = options.category;
+		if (options.status) where.status = options.status;
+		const secrets = await this.list({
+			where,
+			limit: options.limit,
+			offset: options.offset,
+			orderBy: "name ASC"
+		});
+		if (!options.includeExpired) return secrets.filter((secret) => !secret.isExpired());
+		return secrets;
+	}
+	/**
+	* List all active secrets for a tenant
+	*/
+	async listActive(tenantId) {
+		return this.listSecrets(tenantId, { status: "active" });
+	}
+	/**
+	* List a tenant's secrets by category
+	*/
+	async listByCategory(tenantId, category) {
+		return this.listSecrets(tenantId, {
+			category,
+			status: "active"
+		});
+	}
+	/**
+	* List a tenant's secrets that need attention (expired or about to expire)
+	*/
+	async listExpiring(tenantId, daysAhead = 30) {
+		const futureDate = /* @__PURE__ */ new Date();
+		futureDate.setDate(futureDate.getDate() + daysAhead);
+		return await this.list({
+			where: {
+				tenantId,
+				status: "active",
+				"expiresAt !=": null,
+				"expiresAt <": futureDate.toISOString()
+			},
+			orderBy: "expiresAt ASC"
+		});
+	}
+	/**
+	* Get categories used in a tenant's secrets
+	*/
+	async getCategories(tenantId) {
+		const secrets = await this.list({ where: { tenantId } });
+		const categories = new Set(secrets.map((s) => s.category).filter(Boolean));
+		return Array.from(categories).sort();
+	}
+	/**
+	* Count a tenant's secrets by status
+	*/
+	async countByStatus(tenantId) {
+		const secrets = await this.list({ where: { tenantId } });
+		const counts = {
+			active: 0,
+			disabled: 0,
+			expired: 0
+		};
+		for (const secret of secrets) if (secret.isExpired()) counts.expired++;
+		else counts[secret.status]++;
+		return counts;
+	}
+	/**
+	* Delete a tenant's secret by name
+	*/
+	async deleteByName(tenantId, name) {
+		const secret = await this.findByName(tenantId, name);
+		if (!secret) return false;
+		await secret.delete();
+		return true;
+	}
+};
+//#endregion
+//#region src/collections/TenantKeyCollection.ts
+/**
+* TenantKeyCollection - Collection manager for TenantKey objects
+* @packageDocumentation
+*/
+/**
+* Collection for managing TenantKey objects
+*/
+var TenantKeyCollection = class extends SmrtCollection {
+	static _itemClass = TenantKey;
+	/**
+	* Get the active key for a tenant
+	*/
+	async getActiveKey(tenantId) {
+		return this.get({
+			tenantId,
+			status: "active"
+		});
+	}
+	/**
+	* List all key versions for a tenant
+	*/
+	async listKeyVersions(tenantId) {
+		return this.list({
+			where: { tenantId },
+			orderBy: "version DESC"
+		});
+	}
+	/**
+	* Get a specific key version for a tenant
+	*/
+	async getKeyVersion(tenantId, version) {
+		return this.get({
+			tenantId,
+			version
+		});
+	}
+	/**
+	* Find keys that need rotation
+	*/
+	async findKeysNeedingRotation() {
+		const now = /* @__PURE__ */ new Date();
+		return this.list({
+			where: {
+				status: "active",
+				"rotateAfter !=": null,
+				"rotateAfter <": now.toISOString()
+			},
+			orderBy: "rotateAfter ASC"
+		});
+	}
+	/**
+	* List all active keys across all tenants
+	*/
+	async listAllActiveKeys() {
+		return this.list({
+			where: { status: "active" },
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Count keys by status
+	*/
+	async countByStatus() {
+		const keys = await this.list({});
+		const counts = {
+			active: 0,
+			rotating: 0,
+			retired: 0,
+			compromised: 0
+		};
+		for (const key of keys) counts[key.status]++;
+		return counts;
+	}
+	/**
+	* Mark a key as compromised (should trigger re-encryption)
+	*/
+	async markCompromised(tenantId, keyId) {
+		const key = await this.get({
+			id: keyId,
+			tenantId
+		});
+		if (!key) return false;
+		key.markCompromised();
+		await key.save();
+		return true;
+	}
+	/**
+	* Delete old retired keys that are no longer needed
+	* @param olderThanDays Delete keys retired more than this many days ago
+	*/
+	async cleanupRetiredKeys(olderThanDays = 90) {
+		const cutoffDate = /* @__PURE__ */ new Date();
+		cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);
+		const oldKeys = await this.list({ where: {
+			status: "retired",
+			"retiredAt <": cutoffDate.toISOString()
+		} });
+		let count = 0;
+		for (const key of oldKeys) {
+			await key.delete();
+			count++;
+		}
+		return count;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@happyvertical+logger@0.74.11_@sentry+node@10.62.0_@opentelemetry+core@2.7.0_@opentelemetry+api@1.9.1__/node_modules/@happyvertical/logger/dist/index.js
+var ConsoleLogger = class ConsoleLogger {
+	constructor(level = "info") {
+		this.level = level;
+	}
+	static LEVELS = [
+		"debug",
+		"info",
+		"warn",
+		"error"
+	];
+	/**
+	* Check if a log level should be output
+	*
+	* @param level - Log level to check
+	* @returns True if level meets threshold
+	*/
+	shouldLog(level) {
+		const currentIndex = ConsoleLogger.LEVELS.indexOf(this.level);
+		return ConsoleLogger.LEVELS.indexOf(level) >= currentIndex;
+	}
+	/**
+	* Format context for console output
+	*
+	* @param context - Structured metadata
+	* @returns Formatted context string
+	*/
+	formatContext(context) {
+		if (!context || Object.keys(context).length === 0) return "";
+		return ` ${JSON.stringify(context)}`;
+	}
+	debug(message, context) {
+		if (this.shouldLog("debug")) console.debug(`[DEBUG] ${message}${this.formatContext(context)}`);
+	}
+	info(message, context) {
+		if (this.shouldLog("info")) console.info(`[INFO] ${message}${this.formatContext(context)}`);
+	}
+	warn(message, context) {
+		if (this.shouldLog("warn")) console.warn(`[WARN] ${message}${this.formatContext(context)}`);
+	}
+	error(message, context) {
+		if (this.shouldLog("error")) console.error(`[ERROR] ${message}${this.formatContext(context)}`);
+	}
+};
+var NoopLogger = class {
+	debug(_message, _context) {}
+	info(_message, _context) {}
+	warn(_message, _context) {}
+	error(_message, _context) {}
+};
+function createLogger(config) {
+	if (typeof config === "boolean") {
+		if (!config) return new NoopLogger();
+		return new ConsoleLogger(loadEnvConfig({}, {
+			packageName: "logger",
+			schema: { level: "string" }
+		}).level || "info");
+	}
+	return new ConsoleLogger(loadEnvConfig(config, {
+		packageName: "logger",
+		schema: { level: "string" }
+	}).level || "info");
+}
+//#endregion
+//#region src/services/SecretService.ts
+var logger = createLogger({ level: "info" });
+var SecretKeyDriftError = class extends Error {
+	code = "SECRET_KEY_DRIFT";
+	tenantId;
+	report;
+	cause;
+	constructor(message, tenantId, report, cause) {
+		super(message);
+		this.name = "SecretKeyDriftError";
+		this.tenantId = tenantId;
+		this.report = report;
+		this.cause = cause;
+	}
+};
+/**
+* SecretService provides high-level operations for managing per-tenant secrets.
+*
+* It integrates with:
+* - `@happyvertical/secrets` for envelope encryption
+* - `@happyvertical/smrt-tenancy` for tenant context
+* - Audit logging for compliance
+*
+* @example
+* ```typescript
+* import { SecretService } from '@happyvertical/smrt-secrets';
+* import { withTenant } from '@happyvertical/smrt-tenancy';
+*
+* const service = await SecretService.create({ db });
+*
+* await withTenant({ tenantId: 'tenant-123' }, async () => {
+*   // Store a secret
+*   await service.store('stripe-api-key', 'sk_live_xxx', {
+*     category: 'api-keys',
+*     description: 'Stripe production API key'
+*   });
+*
+*   // Retrieve the secret
+*   const secret = await service.retrieve('stripe-api-key');
+*   console.log(secret.value); // 'sk_live_xxx'
+*
+*   // List secret names (without values)
+*   const secrets = await service.list();
+*
+*   // Rotate tenant's encryption key
+*   await service.rotateKey();
+*
+*   // Delete a secret
+*   await service.delete('stripe-api-key');
+* });
+* ```
+*/
+var SecretService = class SecretService {
+	db;
+	secretStore;
+	secrets;
+	tenantKeys;
+	auditLogs;
+	auditEnabled;
+	amkEnvVar;
+	amkKeyId;
+	constructor(db, secretStore, secrets, tenantKeys, auditLogs, auditEnabled, amkEnvVar, amkKeyId) {
+		this.db = db;
+		this.secretStore = secretStore;
+		this.secrets = secrets;
+		this.tenantKeys = tenantKeys;
+		this.auditLogs = auditLogs;
+		this.auditEnabled = auditEnabled;
+		this.amkEnvVar = amkEnvVar;
+		this.amkKeyId = amkKeyId;
+	}
+	/**
+	* Create a new SecretService instance
+	*/
+	static async create(options) {
+		const { db, amkEnvVar = "SMRT_SECRET_MASTER_KEY", amkKeyId = "smrt-amk-v1", auditEnabled = true } = options;
+		const secretStore = await getSecretStore({
+			type: "database",
+			db,
+			amk: {
+				provider: "env",
+				keyEnvVar: amkEnvVar,
+				keyId: amkKeyId
+			}
+		});
+		const baseOptions = { db };
+		return new SecretService(db, secretStore, await SecretCollection.create(baseOptions), await TenantKeyCollection.create(baseOptions), await SecretAuditLogCollection.create(baseOptions), auditEnabled, amkEnvVar, amkKeyId);
+	}
+	/**
+	* Store a secret for the current tenant
+	*/
+	async store(name, value, options = {}) {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		let isUpdate = false;
+		try {
+			let existing = await this.secrets.findByName(tenantId, name);
+			if (existing && existing.tenantId !== tenantId) existing = null;
+			isUpdate = existing !== null;
+			const envelope = await this.secretStore.encrypt(tenantId, name, value, { metadata: options.metadata ? this.serializeMetadata(options.metadata) : void 0 });
+			if (existing) {
+				existing.encryptedValue = JSON.stringify(envelope);
+				existing.description = options.description ?? existing.description;
+				existing.category = options.category ?? existing.category;
+				existing.expiresAt = options.expiresAt ?? existing.expiresAt;
+				existing.metadata = options.metadata ?? existing.metadata;
+				await existing.save();
+				await this.audit(existing.id ?? null, name, userId, "update", "success");
+				return existing;
+			}
+			const secret = await this.secrets.create({
+				name,
+				description: options.description ?? "",
+				category: options.category ?? "",
+				encryptedValue: JSON.stringify(envelope),
+				keyVersion: 1,
+				status: "active",
+				expiresAt: options.expiresAt ?? null,
+				metadata: options.metadata ?? {},
+				context: tenantId,
+				tenantId
+			});
+			await this.audit(secret.id ?? null, name, userId, "create", "success");
+			return secret;
+		} catch (error) {
+			const classifiedError = await this.classifyTenantKeyFailure(tenantId, name, error);
+			await this.audit(null, name, userId, isUpdate ? "update" : "create", "failure", { error: classifiedError.message });
+			throw classifiedError;
+		}
+	}
+	/**
+	* Store a secret for a specific tenant.
+	*
+	* This is useful for integrations that already resolved tenant ownership but
+	* may be running outside the application's ambient tenant context.
+	*/
+	async storeForTenant(tenantId, name, value, options = {}) {
+		return withTenant({ tenantId }, () => this.store(name, value, options));
+	}
+	/**
+	* Retrieve a secret for the current tenant
+	*/
+	async retrieve(name) {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		let audited = false;
+		try {
+			const secret = await this.secrets.findByName(tenantId, name);
+			if (!secret || secret.tenantId !== tenantId) {
+				await this.audit(null, name, userId, "read", "failure", { error: "Secret not found" });
+				audited = true;
+				throw new Error(`Secret '${name}' not found`);
+			}
+			if (!secret.isUsable()) {
+				const reason = secret.isExpired() ? "Secret expired" : "Secret disabled";
+				await this.audit(secret.id ?? null, name, userId, "read", "failure", { error: reason });
+				audited = true;
+				throw new Error(reason);
+			}
+			const envelope = JSON.parse(secret.encryptedValue);
+			const decrypted = await this.secretStore.decrypt(tenantId, envelope);
+			const previousLastAccessedAt = secret.lastAccessedAt;
+			const previousAccessCount = secret.accessCount;
+			try {
+				secret.recordAccess();
+				await secret.save();
+			} catch (trackingError) {
+				secret.lastAccessedAt = previousLastAccessedAt;
+				secret.accessCount = previousAccessCount;
+				logger.error("Failed to update secret access tracking", { error: trackingError });
+			}
+			await this.audit(secret.id ?? null, name, userId, "read", "success");
+			return {
+				value: decrypted.value,
+				name: secret.name,
+				description: secret.description,
+				category: secret.category,
+				expiresAt: secret.expiresAt,
+				createdAt: secret.created_at ?? /* @__PURE__ */ new Date(),
+				lastAccessedAt: secret.lastAccessedAt,
+				accessCount: secret.accessCount,
+				metadata: secret.metadata
+			};
+		} catch (error) {
+			const classifiedError = await this.classifyTenantKeyFailure(tenantId, name, error);
+			if (!audited) await this.audit(null, name, userId, "read", "failure", { error: classifiedError.message });
+			throw classifiedError;
+		}
+	}
+	/**
+	* Retrieve a secret for a specific tenant.
+	*/
+	async retrieveForTenant(tenantId, name) {
+		return withTenant({ tenantId }, () => this.retrieve(name));
+	}
+	/**
+	* Diagnose tenant secret/key drift without exposing decrypted values.
+	*/
+	async diagnoseTenantSecretKeyDrift(tenantId, options = {}) {
+		const activeSecrets = await this.listActiveSecretRowsForDiagnosis(tenantId, options.secretNames);
+		const tenantEncryptionKeys = await this.listTenantEncryptionKeyRows(tenantId);
+		const smrtTenantKeyRows = await this.listSmrtTenantKeysForDiagnosis(tenantId);
+		const smrtTenantKeys = smrtTenantKeyRows.keys;
+		const issues = [];
+		const activeTenantEncryptionKeys = tenantEncryptionKeys.filter((key) => key.status === "active");
+		const activeSmrtTenantKeys = smrtTenantKeys.filter((key) => key.status === "active");
+		const amk = this.getConfiguredAmkForDiagnosis();
+		if (!amk.usable) issues.push({
+			code: "amk_unavailable",
+			severity: "error",
+			message: amk.error ?? `AMK ${this.amkEnvVar} is unavailable`,
+			repairAction: "none",
+			details: {
+				amkEnvVar: this.amkEnvVar,
+				amkKeyId: this.amkKeyId
+			}
+		});
+		if (activeSecrets.length > 0 && activeTenantEncryptionKeys.length === 0) issues.push({
+			code: "missing_active_tenant_encryption_key",
+			severity: "error",
+			message: "Active tenant secrets exist, but tenant_encryption_keys has no active key for encryption.",
+			repairAction: "store-fresh-secret-value",
+			sourceTable: "tenant_encryption_keys",
+			details: { activeSecretCount: activeSecrets.length }
+		});
+		if (smrtTenantKeyRows.error) issues.push({
+			code: "smrt_tenant_keys_query_failed",
+			severity: "error",
+			message: "Unable to query SMRT tenant_keys while diagnosing tenant secret key drift.",
+			repairAction: "none",
+			sourceTable: "tenant_keys",
+			details: { error: smrtTenantKeyRows.error.message }
+		});
+		if (activeTenantEncryptionKeys.length > 1) issues.push({
+			code: "multiple_active_tenant_encryption_keys",
+			severity: "error",
+			message: "tenant_encryption_keys has multiple active keys for this tenant; encryption may use an arbitrary active key.",
+			repairAction: "none",
+			sourceTable: "tenant_encryption_keys",
+			details: { activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length }
+		});
+		const activeKeyChecks = [];
+		for (const key of tenantEncryptionKeys) {
+			const check = amk.value ? this.checkWrappedKey(key.wrapped_key, amk.value) : {
+				usable: false,
+				error: amk.error
+			};
+			if (key.status === "active") activeKeyChecks.push(check);
+			if (key.status === "active" && key.amk_key_id !== this.amkKeyId) issues.push({
+				code: "active_tenant_encryption_key_amk_mismatch",
+				severity: "warning",
+				message: "Active tenant_encryption_keys row was wrapped by a different AMK key id than this SecretService is configured to use.",
+				repairAction: "none",
+				keyId: key.id,
+				sourceTable: "tenant_encryption_keys",
+				details: {
+					rowAmkKeyId: key.amk_key_id,
+					configuredAmkKeyId: this.amkKeyId
+				}
+			});
+			if (key.status === "active" && !check.usable && amk.value) issues.push({
+				code: "active_tenant_encryption_key_unwrap_failed",
+				severity: "error",
+				message: "Active tenant_encryption_keys row cannot be unwrapped by the currently configured AMK.",
+				repairAction: "delete-unusable-tenant-encryption-key",
+				keyId: key.id,
+				sourceTable: "tenant_encryption_keys",
+				details: {
+					version: key.version,
+					error: check.error ?? null
+				}
+			});
+		}
+		const usableActiveTenantEncryptionKeyCount = activeKeyChecks.filter((check) => check.usable).length;
+		if (activeSecrets.length > 0 && usableActiveTenantEncryptionKeyCount === 0) issues.push({
+			code: "active_secrets_without_usable_active_key",
+			severity: "error",
+			message: "Active secrets exist, but no active tenant_encryption_keys row can be used with the current AMK.",
+			repairAction: "store-fresh-secret-value",
+			sourceTable: "tenant_encryption_keys",
+			details: {
+				activeSecretCount: activeSecrets.length,
+				activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length
+			}
+		});
+		const keyFingerprintToRow = /* @__PURE__ */ new Map();
+		for (const key of tenantEncryptionKeys) {
+			const fingerprint = this.getWrappedKeyFingerprint(key.wrapped_key);
+			if (fingerprint) keyFingerprintToRow.set(fingerprint, key);
+		}
+		for (const secret of activeSecrets) {
+			const envelope = this.parseSecretEnvelopeForDiagnosis(secret, issues);
+			if (!envelope) continue;
+			const envelopeFingerprint = this.getWrappedKeyFingerprint(envelope.wrappedKey);
+			const envelopeCheck = amk.value ? this.checkWrappedKey(envelope.wrappedKey, amk.value) : {
+				usable: false,
+				error: amk.error,
+				fingerprint: envelopeFingerprint
+			};
+			if (!envelopeCheck.fingerprint) {
+				issues.push({
+					code: "secret_envelope_invalid_wrapped_key",
+					severity: "error",
+					message: "Secret encryptedValue contains an invalid wrapped key format.",
+					repairAction: "delete-unrecoverable-secret",
+					secretId: secret.id,
+					secretName: secret.name,
+					sourceTable: "secrets",
+					details: { error: envelopeCheck.error ?? null }
+				});
+				continue;
+			}
+			const matchingKey = keyFingerprintToRow.get(envelopeCheck.fingerprint);
+			if (!matchingKey) issues.push({
+				code: "secret_envelope_missing_tenant_encryption_key",
+				severity: "error",
+				message: "Secret envelope does not match any tenant_encryption_keys row for this tenant.",
+				repairAction: !amk.value ? "none" : envelopeCheck.usable ? "none" : "delete-unrecoverable-secret",
+				secretId: secret.id,
+				secretName: secret.name,
+				sourceTable: "secrets"
+			});
+			if (!envelopeCheck.usable && amk.value) issues.push({
+				code: "secret_envelope_unwrap_failed",
+				severity: "error",
+				message: "Secret envelope cannot be unwrapped by the currently configured AMK.",
+				repairAction: "delete-unrecoverable-secret",
+				secretId: secret.id,
+				secretName: secret.name,
+				keyId: matchingKey?.id,
+				sourceTable: "secrets",
+				details: { error: envelopeCheck.error ?? null }
+			});
+		}
+		if (activeSecrets.length > 0 && tenantEncryptionKeys.length > 0 && smrtTenantKeys.length === 0 && !smrtTenantKeyRows.error) issues.push({
+			code: "smrt_tenant_keys_not_mirrored",
+			severity: "info",
+			message: "SMRT tenant_keys has no rows for this tenant, while the lower-level tenant_encryption_keys table does. SecretService uses tenant_encryption_keys for encryption.",
+			repairAction: "none",
+			sourceTable: "tenant_keys"
+		});
+		return {
+			tenantId,
+			checkedAt: /* @__PURE__ */ new Date(),
+			ok: !issues.some((issue) => issue.severity === "error"),
+			summary: {
+				activeSecretCount: activeSecrets.length,
+				tenantEncryptionKeyCount: tenantEncryptionKeys.length,
+				activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,
+				usableActiveTenantEncryptionKeyCount,
+				smrtTenantKeyCount: smrtTenantKeys.length,
+				activeSmrtTenantKeyCount: activeSmrtTenantKeys.length
+			},
+			issues
+		};
+	}
+	/**
+	* Diagnose drift for the current tenant context.
+	*/
+	async diagnoseCurrentTenantSecretKeyDrift(options = {}) {
+		return this.diagnoseTenantSecretKeyDrift(requireTenantId(), options);
+	}
+	/**
+	* Delete unrecoverable secret/key rows identified by diagnosis.
+	*
+	* This never attempts to recover or expose secret values. Use dryRun first
+	* to preview destructive changes.
+	*/
+	async repairTenantSecretKeyDrift(tenantId, options = {}) {
+		const dryRun = options.dryRun ?? false;
+		const before = await this.diagnoseTenantSecretKeyDrift(tenantId, options);
+		const secretIds = /* @__PURE__ */ new Set();
+		const secretNames = /* @__PURE__ */ new Map();
+		const tenantEncryptionKeyIds = /* @__PURE__ */ new Set();
+		for (const issue of before.issues) {
+			if (issue.repairAction === "delete-unrecoverable-secret" && issue.secretId) {
+				secretIds.add(issue.secretId);
+				if (issue.secretName) secretNames.set(issue.secretId, issue.secretName);
+			}
+			if (issue.repairAction === "delete-unusable-tenant-encryption-key" && issue.keyId) tenantEncryptionKeyIds.add(issue.keyId);
+		}
+		const wouldDeleteSecrets = secretIds.size;
+		const wouldDeleteTenantEncryptionKeys = tenantEncryptionKeyIds.size;
+		const wouldDeleteUnrecoverableData = wouldDeleteSecrets + wouldDeleteTenantEncryptionKeys > 0;
+		if (!dryRun && wouldDeleteUnrecoverableData && !options.confirmDeleteUnrecoverableData) throw new Error("repairTenantSecretKeyDrift requires confirmDeleteUnrecoverableData: true before deleting encrypted secrets or tenant key rows.");
+		let deletedSecrets = 0;
+		let deletedTenantEncryptionKeys = 0;
+		if (!dryRun) {
+			const runDeletes = async (db) => {
+				return {
+					deletedSecrets: await this.deleteRowsByIds("secrets", tenantId, secretIds, db),
+					deletedTenantEncryptionKeys: await this.deleteRowsByIds("tenant_encryption_keys", tenantId, tenantEncryptionKeyIds, db)
+				};
+			};
+			const txDb = this.db;
+			const deleteResult = typeof txDb.transaction === "function" ? await txDb.transaction((db) => runDeletes(db)) : await runDeletes(this.db);
+			deletedSecrets = deleteResult.deletedSecrets;
+			deletedTenantEncryptionKeys = deleteResult.deletedTenantEncryptionKeys;
+			await this.auditSecretDriftRepairDeletes(tenantId, secretIds, secretNames);
+		}
+		const after = dryRun ? before : await this.diagnoseTenantSecretKeyDrift(tenantId, options);
+		return {
+			tenantId,
+			dryRun,
+			issuesBefore: before.issues,
+			remainingIssues: after.issues,
+			wouldDeleteSecrets,
+			wouldDeleteTenantEncryptionKeys,
+			deletedSecrets,
+			deletedTenantEncryptionKeys,
+			secretNames: Array.from(secretNames.values()).sort(),
+			tenantEncryptionKeyIds: Array.from(tenantEncryptionKeyIds).sort()
+		};
+	}
+	/**
+	* List secrets for the current tenant (names only, not values)
+	*/
+	async list(options = {}) {
+		return this.secrets.listSecrets(requireTenantId(), {
+			category: options.category,
+			status: "active"
+		});
+	}
+	/**
+	* Delete a secret
+	*/
+	async delete(name) {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		const secret = await this.secrets.findByName(tenantId, name);
+		if (!secret || secret.tenantId !== tenantId) return false;
+		try {
+			await secret.delete();
+			await this.audit(secret.id ?? null, name, userId, "delete", "success");
+			return true;
+		} catch (error) {
+			await this.audit(secret.id ?? null, name, userId, "delete", "failure", { error: error.message });
+			throw error;
+		}
+	}
+	/**
+	* Disable a secret (soft delete)
+	*/
+	async disable(name) {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		const secret = await this.secrets.findByName(tenantId, name);
+		if (!secret || secret.tenantId !== tenantId) return false;
+		secret.disable();
+		await secret.save();
+		await this.audit(secret.id ?? null, name, userId, "disable", "success");
+		return true;
+	}
+	/**
+	* Enable a disabled secret
+	*/
+	async enable(name) {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		const secret = await this.secrets.findByName(tenantId, name);
+		if (!secret || secret.tenantId !== tenantId) return false;
+		secret.enable();
+		await secret.save();
+		await this.audit(secret.id ?? null, name, userId, "enable", "success");
+		return true;
+	}
+	/**
+	* Rotate the tenant's encryption key
+	*
+	* This creates a new TDEK and marks the old one as retired.
+	* Existing secrets remain encrypted with the old key and can still
+	* be decrypted (the old key is kept in retired state).
+	*
+	* For full re-encryption, call reencryptAll() after rotation.
+	*/
+	async rotateKey() {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		try {
+			await this.secretStore.rotateTenantKey(tenantId);
+			await this.audit(null, "", userId, "rotate_key", "success", { tenantId });
+		} catch (error) {
+			await this.audit(null, "", userId, "rotate_key", "failure", {
+				tenantId,
+				error: error.message
+			});
+			throw error;
+		}
+	}
+	/**
+	* Re-encrypt all secrets with the current active key
+	*
+	* Call this after key rotation to ensure all secrets use the new key.
+	* This is optional but recommended for security.
+	*/
+	async reencryptAll() {
+		const tenantId = requireTenantId();
+		const userId = this.getCurrentUserId();
+		const secrets = await this.secrets.list({ where: { tenantId } });
+		let success = 0;
+		let failed = 0;
+		for (const secret of secrets) try {
+			const envelope = JSON.parse(secret.encryptedValue);
+			const decrypted = await this.secretStore.decrypt(tenantId, envelope);
+			const newEnvelope = await this.secretStore.encrypt(tenantId, secret.name, decrypted.value);
+			secret.encryptedValue = JSON.stringify(newEnvelope);
+			await secret.save();
+			success++;
+		} catch (error) {
+			failed++;
+			await this.audit(secret.id ?? null, secret.name, userId, "update", "failure", {
+				action: "reencrypt",
+				error: error.message
+			});
+		}
+		return {
+			success,
+			failed
+		};
+	}
+	/**
+	* Get audit logs for the current tenant
+	*/
+	async getAuditLogs(options = {}) {
+		return this.auditLogs.listLogs({
+			tenantId: requireTenantId(),
+			secretName: options.secretName,
+			limit: options.limit ?? 100
+		});
+	}
+	/**
+	* Get secret categories for the current tenant
+	*/
+	async getCategories() {
+		return this.secrets.getCategories(requireTenantId());
+	}
+	/**
+	* Check if a secret exists for the current tenant
+	*/
+	async exists(name) {
+		const tenantId = requireTenantId();
+		const secret = await this.secrets.findByName(tenantId, name);
+		return secret !== null && secret.tenantId === tenantId;
+	}
+	async listActiveSecretRowsForDiagnosis(tenantId, secretNames) {
+		const params = [tenantId];
+		let nameFilter = "";
+		if (secretNames && secretNames.length > 0) {
+			nameFilter = ` AND name IN (${secretNames.map(() => "?").join(", ")})`;
+			params.push(...secretNames);
+		}
+		const result = await this.db.query(`
+        SELECT id, name, encrypted_value, status, tenant_id
+        FROM "secrets"
+        WHERE tenant_id = ? AND status = 'active'${nameFilter}
+        ORDER BY name ASC
+      `, ...params);
+		return this.rowsFromResult(result);
+	}
+	async listTenantEncryptionKeyRows(tenantId) {
+		const result = await this.db.query(`
+        SELECT id, tenant_id, wrapped_key, amk_key_id, status, version,
+          rotate_after, retired_at, created_at, updated_at
+        FROM "tenant_encryption_keys"
+        WHERE tenant_id = ?
+        ORDER BY version DESC
+      `, tenantId);
+		return this.rowsFromResult(result);
+	}
+	async listSmrtTenantKeysForDiagnosis(tenantId) {
+		try {
+			return { keys: await this.tenantKeys.listKeyVersions(tenantId) };
+		} catch (error) {
+			return {
+				keys: [],
+				error: this.toError(error)
+			};
+		}
+	}
+	getConfiguredAmkForDiagnosis() {
+		const keyHex = process.env[this.amkEnvVar];
+		if (!keyHex) return {
+			usable: false,
+			error: `Application Master Key not found in environment variable: ${this.amkEnvVar}`
+		};
+		try {
+			return {
+				usable: true,
+				value: EnvelopeEncryption.parseHexKey(keyHex)
+			};
+		} catch (error) {
+			return {
+				usable: false,
+				error: `Invalid AMK in ${this.amkEnvVar}: ${this.toError(error).message}`
+			};
+		}
+	}
+	checkWrappedKey(wrappedKey, amk) {
+		const fingerprint = this.getWrappedKeyFingerprint(wrappedKey);
+		try {
+			const parsed = EnvelopeEncryption.parseWrappedKey(wrappedKey);
+			EnvelopeEncryption.unwrapKey(parsed.wrappedKey, parsed.iv, parsed.authTag, amk).fill(0);
+			return {
+				usable: true,
+				fingerprint
+			};
+		} catch (error) {
+			return {
+				usable: false,
+				fingerprint,
+				error: this.toError(error).message
+			};
+		}
+	}
+	getWrappedKeyFingerprint(wrappedKey) {
+		try {
+			return EnvelopeEncryption.parseWrappedKey(wrappedKey).wrappedKey;
+		} catch {
+			return;
+		}
+	}
+	parseSecretEnvelopeForDiagnosis(secret, issues) {
+		try {
+			return JSON.parse(secret.encrypted_value);
+		} catch (error) {
+			issues.push({
+				code: "secret_envelope_invalid_json",
+				severity: "error",
+				message: "Secret encryptedValue is not valid EncryptedEnvelope JSON.",
+				repairAction: "delete-unrecoverable-secret",
+				secretId: secret.id,
+				secretName: secret.name,
+				sourceTable: "secrets",
+				details: { error: this.toError(error).message }
+			});
+			return null;
+		}
+	}
+	async deleteRowsByIds(tableName, tenantId, ids, db = this.db) {
+		if (ids.size === 0) return 0;
+		const idList = Array.from(ids);
+		const placeholders = idList.map(() => "?").join(", ");
+		const result = await db.query(`DELETE FROM "${tableName}" WHERE tenant_id = ? AND id IN (${placeholders})`, tenantId, ...idList);
+		return typeof result.rowCount === "number" ? result.rowCount : idList.length;
+	}
+	async auditSecretDriftRepairDeletes(tenantId, secretIds, secretNames) {
+		if (secretIds.size === 0) return;
+		const userId = this.getCurrentUserId();
+		await withTenant({ tenantId }, async () => {
+			for (const secretId of secretIds) await this.audit(secretId, secretNames.get(secretId) ?? "", userId, "delete", "success", {
+				action: "repairTenantSecretKeyDrift",
+				reason: "unrecoverable-secret-key-drift"
+			});
+		});
+	}
+	rowsFromResult(result) {
+		if (Array.isArray(result)) return result;
+		if (result && typeof result === "object" && Array.isArray(result.rows)) return result.rows;
+		return [];
+	}
+	async classifyTenantKeyFailure(tenantId, secretName, error) {
+		const normalized = this.toError(error);
+		if (!this.shouldClassifyTenantKeyFailure(normalized)) return normalized;
+		try {
+			const report = await this.diagnoseTenantSecretKeyDrift(tenantId, { secretNames: [secretName] });
+			const errorCodes = report.issues.filter((issue) => issue.severity === "error").map((issue) => issue.code);
+			if (errorCodes.length === 0) return normalized;
+			return new SecretKeyDriftError(`Secret '${secretName}' for tenant '${tenantId}' failed because secret key drift was detected: ${[...new Set(errorCodes)].join(", ")}. Run diagnoseTenantSecretKeyDrift() for details and repairTenantSecretKeyDrift() for explicit cleanup of unrecoverable rows.`, tenantId, report, normalized);
+		} catch {
+			return normalized;
+		}
+	}
+	shouldClassifyTenantKeyFailure(error) {
+		const code = this.getSecretErrorCode(error);
+		if (error instanceof AMKUnavailableError || code === "AMK_UNAVAILABLE") return false;
+		return error instanceof TenantKeyMissingError || error instanceof EncryptionError || error instanceof DecryptionError || code === "TENANT_KEY_MISSING" || code === "ENCRYPTION_FAILED" || code === "DECRYPTION_FAILED";
+	}
+	getSecretErrorCode(error) {
+		const code = error.code;
+		return typeof code === "string" ? code : void 0;
+	}
+	toError(error) {
+		return error instanceof Error ? error : new Error(String(error));
+	}
+	getCurrentUserId() {
+		return getCurrentTenant()?.userId ?? "system";
+	}
+	async audit(secretId, secretName, userId, action, result, details) {
+		if (!this.auditEnabled) return;
+		try {
+			const tenantId = getCurrentTenant()?.tenantId ?? null;
+			await (await this.auditLogs.create(createAuditEntry({
+				secretId,
+				secretName,
+				userId,
+				action,
+				result,
+				details,
+				tenantId
+			}))).save();
+		} catch (error) {
+			logger.error("Failed to write audit log", { error });
+		}
+	}
+	serializeMetadata(metadata) {
+		const result = {};
+		for (const [key, value] of Object.entries(metadata)) result[key] = typeof value === "string" ? value : JSON.stringify(value);
+		return result;
+	}
+};
+//#endregion
+export { SecretAuditLogCollection as a, SecretCollection as i, SecretService as n, TenantKeyCollection as r, SecretKeyDriftError as t };
+
+//# sourceMappingURL=SecretService-DL05eyeI.js.map