@happyvertical/smrt-secrets 0.37.8 → 0.37.10

package/dist/chunks/TenantKey-COz54GJ_.js

@@ -0,0 +1,350 @@
+import { ObjectRegistry, SmrtObject, crossPackageRef, foreignKey, smrt } from "@happyvertical/smrt-core";
+//#region src/__smrt-register__.ts
+ObjectRegistry.registerPackageManifest(JSON.parse("{\"version\":\"1.0.0\",\"timestamp\":1783100574298,\"packageName\":\"@happyvertical/smrt-secrets\",\"packageVersion\":\"0.37.10\",\"objects\":{\"@happyvertical/smrt-secrets:SecretAuditLogCollection\":{\"name\":\"secretauditlogcollection\",\"className\":\"SecretAuditLogCollection\",\"qualifiedName\":\"@happyvertical/smrt-secrets:SecretAuditLogCollection\",\"collection\":\"secretauditlogs\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/secrets/src/collections/SecretAuditLogCollection.ts\",\"packageName\":\"@happyvertical/smrt-secrets\",\"fields\":{},\"methods\":{\"listLogs\":{\"name\":\"listLogs\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"ListAuditLogsOptions\",\"optional\":true}],\"returnType\":\"Promise<SecretAuditLog[]>\",\"isStatic\":false,\"isPublic\":true},\"getSecretHistory\":{\"name\":\"getSecretHistory\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string | null\",\"optional\":false},{\"name\":\"secretName\",\"type\":\"string\",\"optional\":false},{\"name\":\"limit\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<SecretAuditLog[]>\",\"isStatic\":false,\"isPublic\":true},\"getUserActivity\":{\"name\":\"getUserActivity\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string | null\",\"optional\":false},{\"name\":\"userId\",\"type\":\"string\",\"optional\":false},{\"name\":\"limit\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<SecretAuditLog[]>\",\"isStatic\":false,\"isPublic\":true},\"getRecentFailures\":{\"name\":\"getRecentFailures\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string | null\",\"optional\":false},{\"name\":\"limit\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<SecretAuditLog[]>\",\"isStatic\":false,\"isPublic\":true},\"getRecentDenials\":{\"name\":\"getRecentDenials\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string | null\",\"optional\":false},{\"name\":\"limit\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<SecretAuditLog[]>\",\"isStatic\":false,\"isPublic\":true},\"countByAction\":{\"name\":\"countByAction\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string | null\",\"optional\":false},{\"name\":\"since\",\"type\":\"Date\",\"optional\":true}],\"returnType\":\"Promise<Record<SecretAuditAction, number>>\",\"isStatic\":false,\"isPublic\":true},\"countByResult\":{\"name\":\"countByResult\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string | null\",\"optional\":false},{\"name\":\"since\",\"type\":\"Date\",\"optional\":true}],\"returnType\":\"Promise<Record<SecretAuditResult, number>>\",\"isStatic\":false,\"isPublic\":true},\"cleanup\":{\"name\":\"cleanup\",\"async\":true,\"parameters\":[{\"name\":\"olderThanDays\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<number>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"SecretAuditLog\",\"exportName\":\"SecretAuditLogCollection\",\"collectionExportName\":\"SecretAuditLogCollectionCollection\",\"schema\":{\"tableName\":\"secret_audit_log_collections\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"secret_audit_log_collections\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"secret_audit_log_collections_id_idx\",\"columns\":[\"id\"]},{\"name\":\"secret_audit_log_collections_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"7bb61130\"}},\"@happyvertical/smrt-secrets:SecretCollection\":{\"name\":\"secretcollection\",\"className\":\"SecretCollection\",\"qualifiedName\":\"@happyvertical/smrt-secrets:SecretCollection\",\"collection\":\"secrets\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/secrets/src/collections/SecretCollection.ts\",\"packageName\":\"@happyvertical/smrt-secrets\",\"fields\":{},\"methods\":{\"findByName\":{\"name\":\"findByName\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"name\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Secret | null>\",\"isStatic\":false,\"isPublic\":true},\"listSecrets\":{\"name\":\"listSecrets\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"options\",\"type\":\"ListSecretsOptions\",\"optional\":true}],\"returnType\":\"Promise<Secret[]>\",\"isStatic\":false,\"isPublic\":true},\"listActive\":{\"name\":\"listActive\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Secret[]>\",\"isStatic\":false,\"isPublic\":true},\"listByCategory\":{\"name\":\"listByCategory\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"category\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Secret[]>\",\"isStatic\":false,\"isPublic\":true},\"listExpiring\":{\"name\":\"listExpiring\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"daysAhead\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<Secret[]>\",\"isStatic\":false,\"isPublic\":true},\"getCategories\":{\"name\":\"getCategories\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<string[]>\",\"isStatic\":false,\"isPublic\":true},\"countByStatus\":{\"name\":\"countByStatus\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Record<SecretStatus, number>>\",\"isStatic\":false,\"isPublic\":true},\"deleteByName\":{\"name\":\"deleteByName\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"name\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<boolean>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"Secret\",\"exportName\":\"SecretCollection\",\"collectionExportName\":\"SecretCollectionCollection\",\"schema\":{\"tableName\":\"secret_collections\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"secret_collections\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"secret_collections_id_idx\",\"columns\":[\"id\"]},{\"name\":\"secret_collections_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"5f18a721\"}},\"@happyvertical/smrt-secrets:TenantKeyCollection\":{\"name\":\"tenantkeycollection\",\"className\":\"TenantKeyCollection\",\"qualifiedName\":\"@happyvertical/smrt-secrets:TenantKeyCollection\",\"collection\":\"tenantkeys\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/secrets/src/collections/TenantKeyCollection.ts\",\"packageName\":\"@happyvertical/smrt-secrets\",\"fields\":{},\"methods\":{\"getActiveKey\":{\"name\":\"getActiveKey\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<TenantKey | null>\",\"isStatic\":false,\"isPublic\":true},\"listKeyVersions\":{\"name\":\"listKeyVersions\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<TenantKey[]>\",\"isStatic\":false,\"isPublic\":true},\"getKeyVersion\":{\"name\":\"getKeyVersion\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"version\",\"type\":\"number\",\"optional\":false}],\"returnType\":\"Promise<TenantKey | null>\",\"isStatic\":false,\"isPublic\":true},\"findKeysNeedingRotation\":{\"name\":\"findKeysNeedingRotation\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<TenantKey[]>\",\"isStatic\":false,\"isPublic\":true},\"listAllActiveKeys\":{\"name\":\"listAllActiveKeys\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<TenantKey[]>\",\"isStatic\":false,\"isPublic\":true},\"countByStatus\":{\"name\":\"countByStatus\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<Record<TenantKeyStatus, number>>\",\"isStatic\":false,\"isPublic\":true},\"markCompromised\":{\"name\":\"markCompromised\",\"async\":true,\"parameters\":[{\"name\":\"tenantId\",\"type\":\"string\",\"optional\":false},{\"name\":\"keyId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<boolean>\",\"isStatic\":false,\"isPublic\":true},\"cleanupRetiredKeys\":{\"name\":\"cleanupRetiredKeys\",\"async\":true,\"parameters\":[{\"name\":\"olderThanDays\",\"type\":\"number\",\"optional\":true}],\"returnType\":\"Promise<number>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"TenantKey\",\"exportName\":\"TenantKeyCollection\",\"collectionExportName\":\"TenantKeyCollectionCollection\",\"schema\":{\"tableName\":\"tenant_key_collections\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"tenant_key_collections\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"tenant_key_collections_id_idx\",\"columns\":[\"id\"]},{\"name\":\"tenant_key_collections_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"26616d13\"}},\"@happyvertical/smrt-secrets:Secret\":{\"name\":\"secret\",\"className\":\"Secret\",\"qualifiedName\":\"@happyvertical/smrt-secrets:Secret\",\"collection\":\"secrets\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/secrets/src/models/Secret.ts\",\"packageName\":\"@happyvertical/smrt-secrets\",\"fields\":{\"tenantId\":{\"type\":\"text\",\"required\":false,\"default\":\"\",\"_meta\":{\"sqlType\":\"UUID\",\"__tenancy\":{\"isTenantIdField\":true,\"mode\":\"required\",\"field\":\"tenantId\",\"autoFilter\":true,\"autoPopulate\":true,\"allowSuperAdminBypass\":false}}},\"name\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"description\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"category\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"encryptedValue\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"keyVersion\":{\"type\":\"integer\",\"required\":false,\"default\":1},\"status\":{\"type\":\"text\",\"required\":false,\"default\":\"active\"},\"expiresAt\":{\"type\":\"datetime\",\"required\":false},\"lastAccessedAt\":{\"type\":\"datetime\",\"required\":false},\"accessCount\":{\"type\":\"integer\",\"required\":false,\"default\":0},\"metadata\":{\"type\":\"json\",\"required\":false,\"default\":{}}},\"methods\":{\"isActive\":{\"name\":\"isActive\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isExpired\":{\"name\":\"isExpired\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isUsable\":{\"name\":\"isUsable\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"recordAccess\":{\"name\":\"recordAccess\",\"async\":false,\"parameters\":[],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"disable\":{\"name\":\"disable\",\"async\":false,\"parameters\":[],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"enable\":{\"name\":\"enable\",\"async\":false,\"parameters\":[],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tenantScoped\":true,\"api\":{\"include\":[]},\"mcp\":{\"include\":[]},\"cli\":{\"include\":[\"list\"],\"skipApiCheck\":true}},\"extends\":\"SmrtObject\",\"exportName\":\"Secret\",\"collectionExportName\":\"SecretCollection\",\"schema\":{\"tableName\":\"secrets\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"secrets\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"tenant_id\\\" UUID,\\n  \\\"name\\\" TEXT DEFAULT '',\\n  \\\"description\\\" TEXT DEFAULT '',\\n  \\\"category\\\" TEXT DEFAULT '',\\n  \\\"encrypted_value\\\" TEXT DEFAULT '',\\n  \\\"key_version\\\" INTEGER DEFAULT 1,\\n  \\\"status\\\" TEXT DEFAULT 'active',\\n  \\\"expires_at\\\" TIMESTAMP,\\n  \\\"last_accessed_at\\\" TIMESTAMP,\\n  \\\"access_count\\\" INTEGER DEFAULT 0,\\n  \\\"metadata\\\" JSON DEFAULT '{}'\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"name\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"description\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"category\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"encrypted_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"key_version\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false,\"default\":1},\"status\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"active\"},\"expires_at\":{\"type\":\"TIMESTAMP\",\"notNull\":false,\"unique\":false},\"last_accessed_at\":{\"type\":\"TIMESTAMP\",\"notNull\":false,\"unique\":false},\"access_count\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false,\"default\":0},\"metadata\":{\"type\":\"JSON\",\"notNull\":false,\"unique\":false,\"default\":{}}},\"indexes\":[{\"name\":\"secrets_id_idx\",\"columns\":[\"id\"]},{\"name\":\"secrets_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"6298a980\"}},\"@happyvertical/smrt-secrets:SecretAuditLog\":{\"name\":\"secretauditlog\",\"className\":\"SecretAuditLog\",\"qualifiedName\":\"@happyvertical/smrt-secrets:SecretAuditLog\",\"collection\":\"secretauditlogs\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/secrets/src/models/SecretAuditLog.ts\",\"packageName\":\"@happyvertical/smrt-secrets\",\"fields\":{\"tenantId\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"sqlType\":\"UUID\",\"__tenancy\":{\"isTenantIdField\":true,\"mode\":\"required\",\"field\":\"tenantId\",\"autoFilter\":true,\"autoPopulate\":true,\"allowSuperAdminBypass\":false}}},\"secretId\":{\"type\":\"foreignKey\",\"required\":false,\"related\":\"Secret\"},\"secretName\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\"},\"action\":{\"type\":\"text\",\"required\":false,\"default\":\"read\"},\"result\":{\"type\":\"text\",\"required\":false,\"default\":\"success\"},\"ipAddress\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"userAgent\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"details\":{\"type\":\"json\",\"required\":false,\"default\":{}}},\"methods\":{\"isSuccess\":{\"name\":\"isSuccess\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isFailure\":{\"name\":\"isFailure\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isDenied\":{\"name\":\"isDenied\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isReadAction\":{\"name\":\"isReadAction\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isWriteAction\":{\"name\":\"isWriteAction\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isKeyOperation\":{\"name\":\"isKeyOperation\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tenantScoped\":true,\"api\":{\"include\":[]},\"mcp\":{\"include\":[]},\"cli\":{\"include\":[\"list\"],\"skipApiCheck\":true}},\"extends\":\"SmrtObject\",\"exportName\":\"SecretAuditLog\",\"collectionExportName\":\"SecretAuditLogCollection\",\"schema\":{\"tableName\":\"secret_audit_logs\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"secret_audit_logs\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"tenant_id\\\" UUID,\\n  \\\"secret_id\\\" UUID,\\n  \\\"secret_name\\\" TEXT DEFAULT '',\\n  \\\"user_id\\\" UUID,\\n  \\\"action\\\" TEXT DEFAULT 'read',\\n  \\\"result\\\" TEXT DEFAULT 'success',\\n  \\\"ip_address\\\" TEXT DEFAULT '',\\n  \\\"user_agent\\\" TEXT DEFAULT '',\\n  \\\"details\\\" JSON DEFAULT '{}'\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"secret_id\":{\"type\":\"UUID\",\"referenceKind\":\"foreignKey\",\"notNull\":false,\"unique\":false},\"secret_name\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"action\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"read\"},\"result\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"success\"},\"ip_address\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"user_agent\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"details\":{\"type\":\"JSON\",\"notNull\":false,\"unique\":false,\"default\":{}}},\"indexes\":[{\"name\":\"secret_audit_logs_id_idx\",\"columns\":[\"id\"]},{\"name\":\"secret_audit_logs_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"af0d679d\"}},\"@happyvertical/smrt-secrets:TenantKey\":{\"name\":\"tenantkey\",\"className\":\"TenantKey\",\"qualifiedName\":\"@happyvertical/smrt-secrets:TenantKey\",\"collection\":\"tenantkeys\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/secrets/src/models/TenantKey.ts\",\"packageName\":\"@happyvertical/smrt-secrets\",\"fields\":{\"tenantId\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"wrappedKey\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"amkKeyId\":{\"type\":\"text\",\"required\":false,\"default\":\"\"},\"status\":{\"type\":\"text\",\"required\":false,\"default\":\"active\"},\"version\":{\"type\":\"integer\",\"required\":false,\"default\":1},\"rotateAfter\":{\"type\":\"datetime\",\"required\":false},\"retiredAt\":{\"type\":\"datetime\",\"required\":false}},\"methods\":{\"isActive\":{\"name\":\"isActive\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"needsRotation\":{\"name\":\"needsRotation\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isRetired\":{\"name\":\"isRetired\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"isCompromised\":{\"name\":\"isCompromised\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"canDecrypt\":{\"name\":\"canDecrypt\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"canEncrypt\":{\"name\":\"canEncrypt\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"retire\":{\"name\":\"retire\",\"async\":false,\"parameters\":[],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"markCompromised\":{\"name\":\"markCompromised\",\"async\":false,\"parameters\":[],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"api\":{\"include\":[]},\"mcp\":{\"include\":[]},\"cli\":{\"include\":[\"list\",\"get\"],\"skipApiCheck\":true}},\"extends\":\"SmrtObject\",\"exportName\":\"TenantKey\",\"collectionExportName\":\"TenantKeyCollection\",\"schema\":{\"tableName\":\"tenant_keys\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"tenant_keys\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"tenant_id\\\" TEXT DEFAULT '',\\n  \\\"wrapped_key\\\" TEXT DEFAULT '',\\n  \\\"amk_key_id\\\" TEXT DEFAULT '',\\n  \\\"status\\\" TEXT DEFAULT 'active',\\n  \\\"version\\\" INTEGER DEFAULT 1,\\n  \\\"rotate_after\\\" TIMESTAMP,\\n  \\\"retired_at\\\" TIMESTAMP\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"tenant_id\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"wrapped_key\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"amk_key_id\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"\"},\"status\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false,\"default\":\"active\"},\"version\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false,\"default\":1},\"rotate_after\":{\"type\":\"TIMESTAMP\",\"notNull\":false,\"unique\":false},\"retired_at\":{\"type\":\"TIMESTAMP\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"tenant_keys_id_idx\",\"columns\":[\"id\"]},{\"name\":\"tenant_keys_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"79fd7e46\"}}},\"moduleType\":\"smrt\",\"smrtDependencies\":[\"@happyvertical/smrt-core\",\"@happyvertical/smrt-tenancy\"]}"));
+//#endregion
+//#region \0@oxc-project+runtime@0.137.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/models/SecretAuditLog.ts
+var SecretAuditLog = class SecretAuditLog extends SmrtObject {
+	/**
+	* Tenant associated with the audited secret operation.
+	*/
+	tenantId = null;
+	/**
+	* ID of the secret (may be null for deleted secrets)
+	*/
+	secretId = null;
+	/**
+	* Name of the secret at the time of the operation
+	*/
+	secretName = "";
+	/**
+	* ID of the user who performed the action, or `null` for system-initiated
+	* operations with no authenticated user. Stored as a native `uuid` column on
+	* Postgres, so a non-UUID actor sentinel must never reach it —
+	* {@link createAuditEntry} normalizes the `'system'` sentinel to null (#1444).
+	*/
+	userId = null;
+	/**
+	* The action that was performed
+	*/
+	action = "read";
+	/**
+	* Result of the operation
+	*/
+	result = "success";
+	/**
+	* IP address of the client (if available)
+	*/
+	ipAddress = "";
+	/**
+	* User agent string (if available)
+	*/
+	userAgent = "";
+	/**
+	* Additional context about the operation
+	*/
+	details = {};
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.secretId !== void 0) this.secretId = options.secretId;
+		if (options.secretName !== void 0) this.secretName = options.secretName;
+		if (options.userId !== void 0) this.userId = options.userId;
+		if (options.action !== void 0) this.action = options.action;
+		if (options.result !== void 0) this.result = options.result;
+		if (options.ipAddress !== void 0) this.ipAddress = options.ipAddress;
+		if (options.userAgent !== void 0) this.userAgent = options.userAgent;
+		if (options.details !== void 0) this.details = options.details;
+	}
+	/**
+	* Check if this was a successful operation
+	*/
+	isSuccess() {
+		return this.result === "success";
+	}
+	/**
+	* Check if this was a failed operation
+	*/
+	isFailure() {
+		return this.result === "failure";
+	}
+	/**
+	* Check if this was a denied operation (permission denied)
+	*/
+	isDenied() {
+		return this.result === "denied";
+	}
+	/**
+	* Check if this is a read operation
+	*/
+	isReadAction() {
+		return this.action === "read";
+	}
+	/**
+	* Check if this is a write operation (create, update, delete)
+	*/
+	isWriteAction() {
+		return [
+			"create",
+			"update",
+			"delete"
+		].includes(this.action);
+	}
+	/**
+	* Check if this is a key operation
+	*/
+	isKeyOperation() {
+		return this.action === "rotate_key";
+	}
+};
+__decorate([foreignKey("Secret")], SecretAuditLog.prototype, "secretId", void 0);
+__decorate([crossPackageRef("@happyvertical/smrt-users:User")], SecretAuditLog.prototype, "userId", void 0);
+SecretAuditLog = __decorate([smrt({
+	tenantScoped: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: {
+		include: ["list"],
+		skipApiCheck: true
+	}
+})], SecretAuditLog);
+/**
+* Create an audit log entry for a secret operation
+*/
+function createAuditEntry(params) {
+	const tenantId = params.tenantId === void 0 || params.tenantId === "system" ? null : params.tenantId;
+	const userId = params.userId == null || params.userId === "system" || params.userId === "" ? null : params.userId;
+	return {
+		secretId: params.secretId ?? null,
+		secretName: params.secretName,
+		userId,
+		action: params.action,
+		result: params.result,
+		ipAddress: params.ipAddress ?? "",
+		userAgent: params.userAgent ?? "",
+		details: params.details ?? {},
+		tenantId
+	};
+}
+//#endregion
+//#region src/models/Secret.ts
+var Secret = class Secret extends SmrtObject {
+	/**
+	* Tenant that owns this secret. Also stored in context for per-tenant name uniqueness.
+	*/
+	tenantId = "";
+	/**
+	* Unique name for the secret within the tenant
+	*/
+	name = "";
+	/**
+	* Human-readable description
+	*/
+	description = "";
+	/**
+	* Category for organization (e.g., 'database', 'api-key', 'oauth')
+	*/
+	category = "";
+	/**
+	* JSON-encoded EncryptedEnvelope from @happyvertical/secrets
+	*/
+	encryptedValue = "";
+	/**
+	* Version of the tenant key used to encrypt this secret
+	*/
+	keyVersion = 1;
+	/**
+	* Current status of the secret
+	*/
+	status = "active";
+	/**
+	* Optional expiration date
+	*/
+	expiresAt = null;
+	/**
+	* Last time this secret was accessed (decrypted)
+	*/
+	lastAccessedAt = null;
+	/**
+	* Number of times this secret has been accessed
+	*/
+	accessCount = 0;
+	/**
+	* Additional metadata stored with the secret
+	*/
+	metadata = {};
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.name !== void 0) this.name = options.name;
+		if (options.description !== void 0) this.description = options.description;
+		if (options.category !== void 0) this.category = options.category;
+		if (options.encryptedValue !== void 0) this.encryptedValue = options.encryptedValue;
+		if (options.keyVersion !== void 0) this.keyVersion = options.keyVersion;
+		if (options.status !== void 0) this.status = options.status;
+		if (options.expiresAt !== void 0) this.expiresAt = options.expiresAt instanceof Date ? options.expiresAt : options.expiresAt ? new Date(options.expiresAt) : null;
+		if (options.lastAccessedAt !== void 0) this.lastAccessedAt = options.lastAccessedAt instanceof Date ? options.lastAccessedAt : options.lastAccessedAt ? new Date(options.lastAccessedAt) : null;
+		if (options.accessCount !== void 0) this.accessCount = options.accessCount;
+		if (options.metadata !== void 0) this.metadata = options.metadata;
+	}
+	/**
+	* Check if the secret is currently active
+	*/
+	isActive() {
+		return this.status === "active";
+	}
+	/**
+	* Check if the secret has expired
+	*/
+	isExpired() {
+		if (!this.expiresAt) return false;
+		return /* @__PURE__ */ new Date() >= this.expiresAt;
+	}
+	/**
+	* Check if the secret can be used (active and not expired)
+	*/
+	isUsable() {
+		return this.isActive() && !this.isExpired();
+	}
+	/**
+	* Record an access to this secret
+	*/
+	recordAccess() {
+		this.lastAccessedAt = /* @__PURE__ */ new Date();
+		this.accessCount += 1;
+	}
+	/**
+	* Disable the secret
+	*/
+	disable() {
+		this.status = "disabled";
+	}
+	/**
+	* Enable the secret
+	*/
+	enable() {
+		this.status = "active";
+	}
+};
+Secret = __decorate([smrt({
+	tenantScoped: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: {
+		include: ["list"],
+		skipApiCheck: true
+	}
+})], Secret);
+//#endregion
+//#region src/models/TenantKey.ts
+var TenantKey = class TenantKey extends SmrtObject {
+	/**
+	* Tenant ID this key belongs to
+	*/
+	tenantId = "";
+	/**
+	* Wrapped key data (format: wrappedKey:iv:authTag)
+	*/
+	wrappedKey = "";
+	/**
+	* ID of the AMK used to wrap this key
+	*/
+	amkKeyId = "";
+	/**
+	* Current status of the key
+	*/
+	status = "active";
+	/**
+	* Version number (increments on rotation)
+	*/
+	version = 1;
+	/**
+	* Recommended rotation date
+	*/
+	rotateAfter = null;
+	/**
+	* When the key was retired (if applicable)
+	*/
+	retiredAt = null;
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.wrappedKey !== void 0) this.wrappedKey = options.wrappedKey;
+		if (options.amkKeyId !== void 0) this.amkKeyId = options.amkKeyId;
+		if (options.status !== void 0) this.status = options.status;
+		if (options.version !== void 0) this.version = options.version;
+		if (options.rotateAfter !== void 0) this.rotateAfter = options.rotateAfter instanceof Date ? options.rotateAfter : options.rotateAfter ? new Date(options.rotateAfter) : null;
+		if (options.retiredAt !== void 0) this.retiredAt = options.retiredAt instanceof Date ? options.retiredAt : options.retiredAt ? new Date(options.retiredAt) : null;
+	}
+	/**
+	* Check if this key is currently active
+	*/
+	isActive() {
+		return this.status === "active";
+	}
+	/**
+	* Check if this key needs rotation
+	*/
+	needsRotation() {
+		if (!this.rotateAfter) return false;
+		return /* @__PURE__ */ new Date() >= this.rotateAfter;
+	}
+	/**
+	* Check if this key is retired
+	*/
+	isRetired() {
+		return this.status === "retired";
+	}
+	/**
+	* Check if this key is compromised
+	*/
+	isCompromised() {
+		return this.status === "compromised";
+	}
+	/**
+	* Check if this key can be used for decryption
+	* (active or retired keys can decrypt)
+	*/
+	canDecrypt() {
+		return this.status === "active" || this.status === "retired";
+	}
+	/**
+	* Check if this key can be used for encryption
+	* (only active keys should encrypt)
+	*/
+	canEncrypt() {
+		return this.status === "active";
+	}
+	/**
+	* Mark this key as retired
+	*/
+	retire() {
+		this.status = "retired";
+		this.retiredAt = /* @__PURE__ */ new Date();
+	}
+	/**
+	* Mark this key as compromised
+	*/
+	markCompromised() {
+		this.status = "compromised";
+	}
+};
+TenantKey = __decorate([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: {
+		include: ["list", "get"],
+		skipApiCheck: true
+	}
+})], TenantKey);
+//#endregion
+export { createAuditEntry as i, Secret as n, SecretAuditLog as r, TenantKey as t };
+
+//# sourceMappingURL=TenantKey-COz54GJ_.js.map

package/dist/chunks/{TenantKey-CITvBEjb.js.map → TenantKey-COz54GJ_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"TenantKey-CITvBEjb.js","names":[],"sources":["../../src/__smrt-register__.ts","../../src/models/SecretAuditLog.ts","../../src/models/Secret.ts","../../src/models/TenantKey.ts"],"sourcesContent":["/**\n * Self-registers this package's build-time manifest before any @smrt() decorator\n * in the package fires. Fixes issue #1132: in consumer runtimes (tsx, SvelteKit\n * SSR, plain `vite dev`) the decorator's synchronous manifest lookup previously\n * missed because no step populated the global manifest cache — classes got\n * registered with zero fields and `save()` / `toJSON()` silently dropped every\n * declared property.\n *\n * Import this module as the first statement in `src/index.ts` so its top-level\n * side effect runs ahead of any class module's @smrt() decorator.\n *\n * Silent no-op in dev/test, where the vitest plugin already populates manifests\n * via a different path. Only needs to succeed in the published dist output.\n *\n * @see https://github.com/happyvertical/smrt/issues/1132\n */\nimport { ObjectRegistry } from '@happyvertical/smrt-core';\n\n// During library builds, smrtPlugin replaces this entire module with generated\n// code that embeds the scanned manifest inline (#1506/#1507) — published dists\n// never resolve this URL, so downstream bundlers cannot break registration by\n// relocating the compiled module away from dist/manifest.json. The runtime\n// lookup below is the fallback for source-mode runs without that transform.\nObjectRegistry.registerPackageManifest(\n  new URL('./manifest.json', import.meta.url),\n);\n","/**\n * SecretAuditLog model - Audit trail for secret operations\n * @packageDocumentation\n */\n\nimport type {\n  SmrtCreateInput,\n  SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\n\n/**\n * Secret audit action types\n */\nexport type SecretAuditAction =\n  | 'create'\n  | 'read'\n  | 'update'\n  | 'delete'\n  | 'rotate_key'\n  | 'disable'\n  | 'enable'\n  | 'expire';\n\n/**\n * Audit result types\n */\nexport type SecretAuditResult = 'success' | 'failure' | 'denied';\n\n/**\n * Constructor options for {@link SecretAuditLog}. Each field is optional and\n * mirrors a persisted column.\n */\nexport interface SecretAuditLogOptions extends SmrtObjectOptions {\n  tenantId?: string | null;\n  secretId?: string | null;\n  secretName?: string;\n  userId?: string | null;\n  action?: SecretAuditAction;\n  result?: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}\n\n/**\n * SecretAuditLog records all operations on secrets for compliance\n * and security monitoring.\n *\n * Every secret operation (create, read, update, delete, key rotation)\n * is logged with the user, action, result, and relevant details.\n *\n * **Retention**: Audit logs should be retained according to your\n * compliance requirements (typically 1-7 years).\n *\n * @example\n * ```typescript\n * // Query recent audit logs\n * const logs = await auditLogs.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'created_at DESC',\n *   limit: 100\n * });\n *\n * // Filter by action\n * const reads = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     action: 'read'\n *   }\n * });\n *\n * // Filter by secret name\n * const apiKeyLogs = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     secretName: 'stripe-api-key'\n *   }\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `SecretAuditLog` uses the inline `tenantScoped: true` form on `@smrt()` rather than\n// the dedicated `@TenantScoped` decorator. Audit-trail queries are read-mostly and run\n// in mixed contexts — under a tenant for tenant-scoped reports, and (prospectively)\n// under super-admin bypass for compliance review. Cross-tenant audit queries should\n// be wrapped in `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy` at the\n// call site; this package has no such call sites today, so the pattern is\n// prescriptive guidance for compliance tooling rather than current practice. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for compliance review; HTTP exposure is intentionally\n  // excluded, so skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true },\n})\nexport class SecretAuditLog extends SmrtObject {\n  /**\n   * Tenant associated with the audited secret operation.\n   */\n  tenantId: string | null = null;\n\n  /**\n   * ID of the secret (may be null for deleted secrets)\n   */\n  @foreignKey('Secret')\n  secretId: string | null = null;\n\n  /**\n   * Name of the secret at the time of the operation\n   */\n  secretName: string = '';\n\n  /**\n   * ID of the user who performed the action, or `null` for system-initiated\n   * operations with no authenticated user. Stored as a native `uuid` column on\n   * Postgres, so a non-UUID actor sentinel must never reach it —\n   * {@link createAuditEntry} normalizes the `'system'` sentinel to null (#1444).\n   */\n  @crossPackageRef('@happyvertical/smrt-users:User')\n  userId: string | null = null;\n\n  /**\n   * The action that was performed\n   */\n  action: SecretAuditAction = 'read';\n\n  /**\n   * Result of the operation\n   */\n  result: SecretAuditResult = 'success';\n\n  /**\n   * IP address of the client (if available)\n   */\n  ipAddress: string = '';\n\n  /**\n   * User agent string (if available)\n   */\n  userAgent: string = '';\n\n  /**\n   * Additional context about the operation\n   */\n  details: Record<string, unknown> = {};\n\n  constructor(options: SecretAuditLogOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) {\n      this.tenantId = options.tenantId;\n    }\n    if (options.secretId !== undefined) this.secretId = options.secretId;\n    if (options.secretName !== undefined) this.secretName = options.secretName;\n    if (options.userId !== undefined) this.userId = options.userId;\n    if (options.action !== undefined) this.action = options.action;\n    if (options.result !== undefined) this.result = options.result;\n    if (options.ipAddress !== undefined) this.ipAddress = options.ipAddress;\n    if (options.userAgent !== undefined) this.userAgent = options.userAgent;\n    if (options.details !== undefined) this.details = options.details;\n  }\n\n  /**\n   * Check if this was a successful operation\n   */\n  isSuccess(): boolean {\n    return this.result === 'success';\n  }\n\n  /**\n   * Check if this was a failed operation\n   */\n  isFailure(): boolean {\n    return this.result === 'failure';\n  }\n\n  /**\n   * Check if this was a denied operation (permission denied)\n   */\n  isDenied(): boolean {\n    return this.result === 'denied';\n  }\n\n  /**\n   * Check if this is a read operation\n   */\n  isReadAction(): boolean {\n    return this.action === 'read';\n  }\n\n  /**\n   * Check if this is a write operation (create, update, delete)\n   */\n  isWriteAction(): boolean {\n    return ['create', 'update', 'delete'].includes(this.action);\n  }\n\n  /**\n   * Check if this is a key operation\n   */\n  isKeyOperation(): boolean {\n    return this.action === 'rotate_key';\n  }\n}\n\n/**\n * Create an audit log entry for a secret operation\n */\nexport function createAuditEntry(params: {\n  secretId?: string | null;\n  secretName: string;\n  tenantId?: string | null;\n  userId?: string | null;\n  action: SecretAuditAction;\n  result: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}): SmrtCreateInput<SecretAuditLog> {\n  const tenantId =\n    params.tenantId === undefined || params.tenantId === 'system'\n      ? null\n      : params.tenantId;\n\n  // The `userId` column is a native `uuid` on Postgres. A missing actor and the\n  // `'system'`/empty sentinels are not valid UUIDs, so normalize them all to\n  // null — a system-initiated operation has no authenticated user. Callers may\n  // pass `null`/`undefined` directly to express that (#1444).\n  const userId =\n    params.userId == null ||\n    params.userId === 'system' ||\n    params.userId === ''\n      ? null\n      : params.userId;\n\n  const entry: SmrtCreateInput<SecretAuditLog> = {\n    secretId: params.secretId ?? null,\n    secretName: params.secretName,\n    userId,\n    action: params.action,\n    result: params.result,\n    ipAddress: params.ipAddress ?? '',\n    userAgent: params.userAgent ?? '',\n    details: params.details ?? {},\n    tenantId,\n  };\n  return entry;\n}\n","/**\n * Secret model - Tenant-scoped encrypted secrets storage\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Secret status values\n */\nexport type SecretStatus = 'active' | 'disabled' | 'expired';\n\n/**\n * Constructor options for {@link Secret}. Each field is optional and mirrors a\n * persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface SecretOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  name?: string;\n  description?: string;\n  category?: string;\n  encryptedValue?: string;\n  keyVersion?: number;\n  status?: SecretStatus;\n  expiresAt?: Date | string | number | null;\n  lastAccessedAt?: Date | string | number | null;\n  accessCount?: number;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Secret represents an encrypted value stored per-tenant.\n *\n * Secrets are tenant-scoped and use envelope encryption:\n * - Each tenant has their own Data Encryption Key (TDEK)\n * - The TDEK is wrapped by the Application Master Key (AMK)\n * - Secret values are encrypted by the unwrapped TDEK\n *\n * **Security**: This model deliberately excludes API and MCP exposure\n * to prevent accidental secret leakage. Secrets are only accessible\n * via CLI commands or direct service calls.\n *\n * @example\n * ```typescript\n * import { SecretService } from '@happyvertical/smrt-secrets';\n *\n * const service = await SecretService.create({ db });\n *\n * await withTenant({ tenantId: 'tenant-123' }, async () => {\n *   // Store a secret\n *   await service.store('api-key', 'sk_live_xxx', { category: 'stripe' });\n *\n *   // Retrieve (auto-decrypts)\n *   const apiKey = await service.retrieve('api-key');\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `Secret` uses the inline `tenantScoped: true` form on `@smrt()` rather than the\n// dedicated `@TenantScoped` decorator from `@happyvertical/smrt-tenancy`. The boolean\n// form gives us required-mode tenant scoping without depending on the tenancy package\n// at the model layer, while `SecretService` performs manual scoping by setting\n// `context = tenantId` on each row. The `(slug, context)` upsert key derived from the\n// base `SmrtObject` fields is what gives different tenants isolated namespaces for\n// secret names — switching to the decorator without changing the upsert key would\n// surface false-positive name collisions across tenants. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  // NO API or MCP exposure for security\n  api: { include: [] },\n  mcp: { include: [] },\n  // CLI runs in-process; secrets must never be reachable over HTTP, so\n  // skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true }, // Only list names, not values\n})\nexport class Secret extends SmrtObject {\n  /**\n   * Tenant that owns this secret. Also stored in context for per-tenant name uniqueness.\n   */\n  tenantId: string = '';\n\n  /**\n   * Unique name for the secret within the tenant\n   */\n  name: string = '';\n\n  /**\n   * Human-readable description\n   */\n  description: string = '';\n\n  /**\n   * Category for organization (e.g., 'database', 'api-key', 'oauth')\n   */\n  category: string = '';\n\n  /**\n   * JSON-encoded EncryptedEnvelope from @happyvertical/secrets\n   */\n  encryptedValue: string = '';\n\n  /**\n   * Version of the tenant key used to encrypt this secret\n   */\n  keyVersion: number = 1;\n\n  /**\n   * Current status of the secret\n   */\n  status: SecretStatus = 'active';\n\n  /**\n   * Optional expiration date\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * Last time this secret was accessed (decrypted)\n   */\n  lastAccessedAt: Date | null = null;\n\n  /**\n   * Number of times this secret has been accessed\n   */\n  accessCount: number = 0;\n\n  /**\n   * Additional metadata stored with the secret\n   */\n  metadata: Record<string, unknown> = {};\n\n  constructor(options: SecretOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.name !== undefined) this.name = options.name;\n    if (options.description !== undefined)\n      this.description = options.description;\n    if (options.category !== undefined) this.category = options.category;\n    if (options.encryptedValue !== undefined)\n      this.encryptedValue = options.encryptedValue;\n    if (options.keyVersion !== undefined) this.keyVersion = options.keyVersion;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.expiresAt !== undefined) {\n      this.expiresAt =\n        options.expiresAt instanceof Date\n          ? options.expiresAt\n          : options.expiresAt\n            ? new Date(options.expiresAt)\n            : null;\n    }\n    if (options.lastAccessedAt !== undefined) {\n      this.lastAccessedAt =\n        options.lastAccessedAt instanceof Date\n          ? options.lastAccessedAt\n          : options.lastAccessedAt\n            ? new Date(options.lastAccessedAt)\n            : null;\n    }\n    if (options.accessCount !== undefined)\n      this.accessCount = options.accessCount;\n    if (options.metadata !== undefined) this.metadata = options.metadata;\n  }\n\n  /**\n   * Check if the secret is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if the secret has expired\n   */\n  isExpired(): boolean {\n    if (!this.expiresAt) return false;\n    return new Date() >= this.expiresAt;\n  }\n\n  /**\n   * Check if the secret can be used (active and not expired)\n   */\n  isUsable(): boolean {\n    return this.isActive() && !this.isExpired();\n  }\n\n  /**\n   * Record an access to this secret\n   */\n  recordAccess(): void {\n    this.lastAccessedAt = new Date();\n    this.accessCount += 1;\n  }\n\n  /**\n   * Disable the secret\n   */\n  disable(): void {\n    this.status = 'disabled';\n  }\n\n  /**\n   * Enable the secret\n   */\n  enable(): void {\n    this.status = 'active';\n  }\n}\n","/**\n * TenantKey model - Tracks per-tenant Data Encryption Keys (TDEKs)\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Key status values\n */\nexport type TenantKeyStatus = 'active' | 'rotating' | 'retired' | 'compromised';\n\n/**\n * Constructor options for {@link TenantKey}. Each field is optional and mirrors\n * a persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface TenantKeyOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  wrappedKey?: string;\n  amkKeyId?: string;\n  status?: TenantKeyStatus;\n  version?: number;\n  rotateAfter?: Date | string | number | null;\n  retiredAt?: Date | string | number | null;\n}\n\n/**\n * TenantKey tracks the per-tenant Data Encryption Keys (TDEKs).\n *\n * Each tenant has one or more TDEKs stored in wrapped form. The wrapped key\n * can only be decrypted using the Application Master Key (AMK).\n *\n * **Key Lifecycle**:\n * 1. `active` - Current key used for encryption\n * 2. `rotating` - Transitional state during rotation\n * 3. `retired` - Old key kept for decryption of existing secrets\n * 4. `compromised` - Key marked as compromised, should not be used\n *\n * **Note**: This model is NOT tenant-scoped itself because it tracks\n * keys FOR tenants, not secrets owned BY tenants.\n *\n * @example\n * ```typescript\n * // Get active key for a tenant\n * const key = await tenantKeys.get({\n *   tenantId: 'tenant-123',\n *   status: 'active'\n * });\n *\n * // List all key versions for a tenant\n * const versions = await tenantKeys.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'version DESC'\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `TenantKey` is deliberately NOT tenant-scoped — neither via the decorator nor via\n// `tenantScoped: true` on `@smrt()`. The row carries a `tenantId` column because each\n// TDEK belongs to a tenant, but the model itself must remain queryable across tenants\n// (e.g. cross-tenant key-rotation tooling, AMK rewrap jobs, super-admin auditing).\n// Adding the tenancy interceptor here would silently filter out keys the rotation\n// service needs to inspect. See `packages/secrets/CLAUDE.md` \"Known exceptions to\n// monorepo standards\" for the full rationale.\n@smrt({\n  // NOT tenant-scoped - this model tracks keys FOR tenants\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for key-rotation tooling and audit; HTTP exposure is\n  // intentionally excluded, so skipApiCheck acknowledges the divergence.\n  cli: { include: ['list', 'get'], skipApiCheck: true },\n})\nexport class TenantKey extends SmrtObject {\n  /**\n   * Tenant ID this key belongs to\n   */\n  tenantId: string = '';\n\n  /**\n   * Wrapped key data (format: wrappedKey:iv:authTag)\n   */\n  wrappedKey: string = '';\n\n  /**\n   * ID of the AMK used to wrap this key\n   */\n  amkKeyId: string = '';\n\n  /**\n   * Current status of the key\n   */\n  status: TenantKeyStatus = 'active';\n\n  /**\n   * Version number (increments on rotation)\n   */\n  version: number = 1;\n\n  /**\n   * Recommended rotation date\n   */\n  rotateAfter: Date | null = null;\n\n  /**\n   * When the key was retired (if applicable)\n   */\n  retiredAt: Date | null = null;\n\n  constructor(options: TenantKeyOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.wrappedKey !== undefined) this.wrappedKey = options.wrappedKey;\n    if (options.amkKeyId !== undefined) this.amkKeyId = options.amkKeyId;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.version !== undefined) this.version = options.version;\n    if (options.rotateAfter !== undefined) {\n      this.rotateAfter =\n        options.rotateAfter instanceof Date\n          ? options.rotateAfter\n          : options.rotateAfter\n            ? new Date(options.rotateAfter)\n            : null;\n    }\n    if (options.retiredAt !== undefined) {\n      this.retiredAt =\n        options.retiredAt instanceof Date\n          ? options.retiredAt\n          : options.retiredAt\n            ? new Date(options.retiredAt)\n            : null;\n    }\n  }\n\n  /**\n   * Check if this key is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if this key needs rotation\n   */\n  needsRotation(): boolean {\n    if (!this.rotateAfter) return false;\n    return new Date() >= this.rotateAfter;\n  }\n\n  /**\n   * Check if this key is retired\n   */\n  isRetired(): boolean {\n    return this.status === 'retired';\n  }\n\n  /**\n   * Check if this key is compromised\n   */\n  isCompromised(): boolean {\n    return this.status === 'compromised';\n  }\n\n  /**\n   * Check if this key can be used for decryption\n   * (active or retired keys can decrypt)\n   */\n  canDecrypt(): boolean {\n    return this.status === 'active' || this.status === 'retired';\n  }\n\n  /**\n   * Check if this key can be used for encryption\n   * (only active keys should encrypt)\n   */\n  canEncrypt(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Mark this key as retired\n   */\n  retire(): void {\n    this.status = 'retired';\n    this.retiredAt = new Date();\n  }\n\n  /**\n   * Mark this key as compromised\n   */\n  markCompromised(): void {\n    this.status = 'compromised';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;ACuGO,IAAA,iBAAA,MAAM,uBAAuB,WAAW;;;;CAI7C,WAA0B;;;;CAK1B,WAC0B;;;;CAK1B,aAAqB;;;;;;;CAQrB,SACwB;;;;CAKxB,SAA4B;;;;CAK5B,SAA4B;;;;CAK5B,YAAoB;;;;CAKpB,YAAoB;;;;CAKpB,UAAmC,CAAC;CAEpC,YAAY,UAAiC,CAAC,GAAG;EAC/C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GACvB,KAAK,WAAW,QAAQ;EAE1B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC5D;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,eAAwB;EACtB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO;GAAC;GAAU;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,MAAM;CAC5D;;;;CAKA,iBAA0B;EACxB,OAAO,KAAK,WAAW;CACzB;AACF;YAlGG,WAAW,QAAQ,CAAA,GAAA,eAAA,WAAA,YAAA,KAAA,CAAA;YAcnB,gBAAgB,gCAAgC,CAAA,GAAA,eAAA,WAAA,UAAA,KAAA,CAAA;6BA/BlD,KAAK;CACJ,cAAc;CACd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,cAAA;;;;AAiHD,SAAgB,iBAAiB,QAUG;CAClC,MAAM,WACJ,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa,WACjD,OACA,OAAO;CAMb,MAAM,SACJ,OAAO,UAAU,QACjB,OAAO,WAAW,YAClB,OAAO,WAAW,KACd,OACA,OAAO;CAab,OAAO;EAVL,UAAU,OAAO,YAAY;EAC7B,YAAY,OAAO;EACnB;EACA,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,WAAW,OAAO,aAAa;EAC/B,WAAW,OAAO,aAAa;EAC/B,SAAS,OAAO,WAAW,CAAC;EAC5B;CAEK;AACT;;;AChLO,IAAA,SAAA,MAAM,eAAe,WAAW;;;;CAIrC,WAAmB;;;;CAKnB,OAAe;;;;CAKf,cAAsB;;;;CAKtB,WAAmB;;;;CAKnB,iBAAyB;;;;CAKzB,aAAqB;;;;CAKrB,SAAuB;;;;CAKvB,YAAyB;;;;CAKzB,iBAA8B;;;;CAK9B,cAAsB;;;;CAKtB,WAAoC,CAAC;CAErC,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,SAAS,KAAA,GAAW,KAAK,OAAO,QAAQ;EACpD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBAAiB,QAAQ;EAChC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;EAEV,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBACH,QAAQ,0BAA0B,OAC9B,QAAQ,iBACR,QAAQ,iBACN,IAAI,KAAK,QAAQ,cAAc,IAC/B;EAEV,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,IAAI,CAAC,KAAK,WAAW,OAAO;EAC5B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,SAAS,KAAK,CAAC,KAAK,UAAU;CAC5C;;;;CAKA,eAAqB;EACnB,KAAK,iCAAiB,IAAI,KAAK;EAC/B,KAAK,eAAe;CACtB;;;;CAKA,UAAgB;EACd,KAAK,SAAS;CAChB;;;;CAKA,SAAe;EACb,KAAK,SAAS;CAChB;AACF;qBA5IC,KAAK;CACJ,cAAc;CAEd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,MAAA;;;ACHM,IAAA,YAAA,MAAM,kBAAkB,WAAW;;;;CAIxC,WAAmB;;;;CAKnB,aAAqB;;;;CAKrB,WAAmB;;;;CAKnB,SAA0B;;;;CAK1B,UAAkB;;;;CAKlB,cAA2B;;;;CAK3B,YAAyB;CAEzB,YAAY,UAA4B,CAAC,GAAG;EAC1C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;EAC1D,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cACH,QAAQ,uBAAuB,OAC3B,QAAQ,cACR,QAAQ,cACN,IAAI,KAAK,QAAQ,WAAW,IAC5B;EAEV,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;CAEZ;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,IAAI,CAAC,KAAK,aAAa,OAAO;EAC9B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO,KAAK,WAAW;CACzB;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW;CACrD;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,SAAe;EACb,KAAK,SAAS;EACd,KAAK,4BAAY,IAAI,KAAK;CAC5B;;;;CAKA,kBAAwB;EACtB,KAAK,SAAS;CAChB;AACF;wBAhIC,KAAK;CAEJ,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,QAAQ,KAAK;EAAG,cAAc;CAAK;AACtD,CAAC,CAAA,GAAA,SAAA"}
+{"version":3,"file":"TenantKey-COz54GJ_.js","names":[],"sources":["../../src/__smrt-register__.ts","../../src/models/SecretAuditLog.ts","../../src/models/Secret.ts","../../src/models/TenantKey.ts"],"sourcesContent":["/**\n * Self-registers this package's build-time manifest before any @smrt() decorator\n * in the package fires. Fixes issue #1132: in consumer runtimes (tsx, SvelteKit\n * SSR, plain `vite dev`) the decorator's synchronous manifest lookup previously\n * missed because no step populated the global manifest cache — classes got\n * registered with zero fields and `save()` / `toJSON()` silently dropped every\n * declared property.\n *\n * Import this module as the first statement in `src/index.ts` so its top-level\n * side effect runs ahead of any class module's @smrt() decorator.\n *\n * Silent no-op in dev/test, where the vitest plugin already populates manifests\n * via a different path. Only needs to succeed in the published dist output.\n *\n * @see https://github.com/happyvertical/smrt/issues/1132\n */\nimport { ObjectRegistry } from '@happyvertical/smrt-core';\n\n// During library builds, smrtPlugin replaces this entire module with generated\n// code that embeds the scanned manifest inline (#1506/#1507) — published dists\n// never resolve this URL, so downstream bundlers cannot break registration by\n// relocating the compiled module away from dist/manifest.json. The runtime\n// lookup below is the fallback for source-mode runs without that transform.\nObjectRegistry.registerPackageManifest(\n  new URL('./manifest.json', import.meta.url),\n);\n","/**\n * SecretAuditLog model - Audit trail for secret operations\n * @packageDocumentation\n */\n\nimport type {\n  SmrtCreateInput,\n  SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\n\n/**\n * Secret audit action types\n */\nexport type SecretAuditAction =\n  | 'create'\n  | 'read'\n  | 'update'\n  | 'delete'\n  | 'rotate_key'\n  | 'disable'\n  | 'enable'\n  | 'expire';\n\n/**\n * Audit result types\n */\nexport type SecretAuditResult = 'success' | 'failure' | 'denied';\n\n/**\n * Constructor options for {@link SecretAuditLog}. Each field is optional and\n * mirrors a persisted column.\n */\nexport interface SecretAuditLogOptions extends SmrtObjectOptions {\n  tenantId?: string | null;\n  secretId?: string | null;\n  secretName?: string;\n  userId?: string | null;\n  action?: SecretAuditAction;\n  result?: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}\n\n/**\n * SecretAuditLog records all operations on secrets for compliance\n * and security monitoring.\n *\n * Every secret operation (create, read, update, delete, key rotation)\n * is logged with the user, action, result, and relevant details.\n *\n * **Retention**: Audit logs should be retained according to your\n * compliance requirements (typically 1-7 years).\n *\n * @example\n * ```typescript\n * // Query recent audit logs\n * const logs = await auditLogs.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'created_at DESC',\n *   limit: 100\n * });\n *\n * // Filter by action\n * const reads = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     action: 'read'\n *   }\n * });\n *\n * // Filter by secret name\n * const apiKeyLogs = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     secretName: 'stripe-api-key'\n *   }\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `SecretAuditLog` uses the inline `tenantScoped: true` form on `@smrt()` rather than\n// the dedicated `@TenantScoped` decorator. Audit-trail queries are read-mostly and run\n// in mixed contexts — under a tenant for tenant-scoped reports, and (prospectively)\n// under super-admin bypass for compliance review. Cross-tenant audit queries should\n// be wrapped in `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy` at the\n// call site; this package has no such call sites today, so the pattern is\n// prescriptive guidance for compliance tooling rather than current practice. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for compliance review; HTTP exposure is intentionally\n  // excluded, so skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true },\n})\nexport class SecretAuditLog extends SmrtObject {\n  /**\n   * Tenant associated with the audited secret operation.\n   */\n  tenantId: string | null = null;\n\n  /**\n   * ID of the secret (may be null for deleted secrets)\n   */\n  @foreignKey('Secret')\n  secretId: string | null = null;\n\n  /**\n   * Name of the secret at the time of the operation\n   */\n  secretName: string = '';\n\n  /**\n   * ID of the user who performed the action, or `null` for system-initiated\n   * operations with no authenticated user. Stored as a native `uuid` column on\n   * Postgres, so a non-UUID actor sentinel must never reach it —\n   * {@link createAuditEntry} normalizes the `'system'` sentinel to null (#1444).\n   */\n  @crossPackageRef('@happyvertical/smrt-users:User')\n  userId: string | null = null;\n\n  /**\n   * The action that was performed\n   */\n  action: SecretAuditAction = 'read';\n\n  /**\n   * Result of the operation\n   */\n  result: SecretAuditResult = 'success';\n\n  /**\n   * IP address of the client (if available)\n   */\n  ipAddress: string = '';\n\n  /**\n   * User agent string (if available)\n   */\n  userAgent: string = '';\n\n  /**\n   * Additional context about the operation\n   */\n  details: Record<string, unknown> = {};\n\n  constructor(options: SecretAuditLogOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) {\n      this.tenantId = options.tenantId;\n    }\n    if (options.secretId !== undefined) this.secretId = options.secretId;\n    if (options.secretName !== undefined) this.secretName = options.secretName;\n    if (options.userId !== undefined) this.userId = options.userId;\n    if (options.action !== undefined) this.action = options.action;\n    if (options.result !== undefined) this.result = options.result;\n    if (options.ipAddress !== undefined) this.ipAddress = options.ipAddress;\n    if (options.userAgent !== undefined) this.userAgent = options.userAgent;\n    if (options.details !== undefined) this.details = options.details;\n  }\n\n  /**\n   * Check if this was a successful operation\n   */\n  isSuccess(): boolean {\n    return this.result === 'success';\n  }\n\n  /**\n   * Check if this was a failed operation\n   */\n  isFailure(): boolean {\n    return this.result === 'failure';\n  }\n\n  /**\n   * Check if this was a denied operation (permission denied)\n   */\n  isDenied(): boolean {\n    return this.result === 'denied';\n  }\n\n  /**\n   * Check if this is a read operation\n   */\n  isReadAction(): boolean {\n    return this.action === 'read';\n  }\n\n  /**\n   * Check if this is a write operation (create, update, delete)\n   */\n  isWriteAction(): boolean {\n    return ['create', 'update', 'delete'].includes(this.action);\n  }\n\n  /**\n   * Check if this is a key operation\n   */\n  isKeyOperation(): boolean {\n    return this.action === 'rotate_key';\n  }\n}\n\n/**\n * Create an audit log entry for a secret operation\n */\nexport function createAuditEntry(params: {\n  secretId?: string | null;\n  secretName: string;\n  tenantId?: string | null;\n  userId?: string | null;\n  action: SecretAuditAction;\n  result: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}): SmrtCreateInput<SecretAuditLog> {\n  const tenantId =\n    params.tenantId === undefined || params.tenantId === 'system'\n      ? null\n      : params.tenantId;\n\n  // The `userId` column is a native `uuid` on Postgres. A missing actor and the\n  // `'system'`/empty sentinels are not valid UUIDs, so normalize them all to\n  // null — a system-initiated operation has no authenticated user. Callers may\n  // pass `null`/`undefined` directly to express that (#1444).\n  const userId =\n    params.userId == null ||\n    params.userId === 'system' ||\n    params.userId === ''\n      ? null\n      : params.userId;\n\n  const entry: SmrtCreateInput<SecretAuditLog> = {\n    secretId: params.secretId ?? null,\n    secretName: params.secretName,\n    userId,\n    action: params.action,\n    result: params.result,\n    ipAddress: params.ipAddress ?? '',\n    userAgent: params.userAgent ?? '',\n    details: params.details ?? {},\n    tenantId,\n  };\n  return entry;\n}\n","/**\n * Secret model - Tenant-scoped encrypted secrets storage\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Secret status values\n */\nexport type SecretStatus = 'active' | 'disabled' | 'expired';\n\n/**\n * Constructor options for {@link Secret}. Each field is optional and mirrors a\n * persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface SecretOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  name?: string;\n  description?: string;\n  category?: string;\n  encryptedValue?: string;\n  keyVersion?: number;\n  status?: SecretStatus;\n  expiresAt?: Date | string | number | null;\n  lastAccessedAt?: Date | string | number | null;\n  accessCount?: number;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Secret represents an encrypted value stored per-tenant.\n *\n * Secrets are tenant-scoped and use envelope encryption:\n * - Each tenant has their own Data Encryption Key (TDEK)\n * - The TDEK is wrapped by the Application Master Key (AMK)\n * - Secret values are encrypted by the unwrapped TDEK\n *\n * **Security**: This model deliberately excludes API and MCP exposure\n * to prevent accidental secret leakage. Secrets are only accessible\n * via CLI commands or direct service calls.\n *\n * @example\n * ```typescript\n * import { SecretService } from '@happyvertical/smrt-secrets';\n *\n * const service = await SecretService.create({ db });\n *\n * await withTenant({ tenantId: 'tenant-123' }, async () => {\n *   // Store a secret\n *   await service.store('api-key', 'sk_live_xxx', { category: 'stripe' });\n *\n *   // Retrieve (auto-decrypts)\n *   const apiKey = await service.retrieve('api-key');\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `Secret` uses the inline `tenantScoped: true` form on `@smrt()` rather than the\n// dedicated `@TenantScoped` decorator from `@happyvertical/smrt-tenancy`. The boolean\n// form gives us required-mode tenant scoping without depending on the tenancy package\n// at the model layer, while `SecretService` performs manual scoping by setting\n// `context = tenantId` on each row. The `(slug, context)` upsert key derived from the\n// base `SmrtObject` fields is what gives different tenants isolated namespaces for\n// secret names — switching to the decorator without changing the upsert key would\n// surface false-positive name collisions across tenants. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  // NO API or MCP exposure for security\n  api: { include: [] },\n  mcp: { include: [] },\n  // CLI runs in-process; secrets must never be reachable over HTTP, so\n  // skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true }, // Only list names, not values\n})\nexport class Secret extends SmrtObject {\n  /**\n   * Tenant that owns this secret. Also stored in context for per-tenant name uniqueness.\n   */\n  tenantId: string = '';\n\n  /**\n   * Unique name for the secret within the tenant\n   */\n  name: string = '';\n\n  /**\n   * Human-readable description\n   */\n  description: string = '';\n\n  /**\n   * Category for organization (e.g., 'database', 'api-key', 'oauth')\n   */\n  category: string = '';\n\n  /**\n   * JSON-encoded EncryptedEnvelope from @happyvertical/secrets\n   */\n  encryptedValue: string = '';\n\n  /**\n   * Version of the tenant key used to encrypt this secret\n   */\n  keyVersion: number = 1;\n\n  /**\n   * Current status of the secret\n   */\n  status: SecretStatus = 'active';\n\n  /**\n   * Optional expiration date\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * Last time this secret was accessed (decrypted)\n   */\n  lastAccessedAt: Date | null = null;\n\n  /**\n   * Number of times this secret has been accessed\n   */\n  accessCount: number = 0;\n\n  /**\n   * Additional metadata stored with the secret\n   */\n  metadata: Record<string, unknown> = {};\n\n  constructor(options: SecretOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.name !== undefined) this.name = options.name;\n    if (options.description !== undefined)\n      this.description = options.description;\n    if (options.category !== undefined) this.category = options.category;\n    if (options.encryptedValue !== undefined)\n      this.encryptedValue = options.encryptedValue;\n    if (options.keyVersion !== undefined) this.keyVersion = options.keyVersion;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.expiresAt !== undefined) {\n      this.expiresAt =\n        options.expiresAt instanceof Date\n          ? options.expiresAt\n          : options.expiresAt\n            ? new Date(options.expiresAt)\n            : null;\n    }\n    if (options.lastAccessedAt !== undefined) {\n      this.lastAccessedAt =\n        options.lastAccessedAt instanceof Date\n          ? options.lastAccessedAt\n          : options.lastAccessedAt\n            ? new Date(options.lastAccessedAt)\n            : null;\n    }\n    if (options.accessCount !== undefined)\n      this.accessCount = options.accessCount;\n    if (options.metadata !== undefined) this.metadata = options.metadata;\n  }\n\n  /**\n   * Check if the secret is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if the secret has expired\n   */\n  isExpired(): boolean {\n    if (!this.expiresAt) return false;\n    return new Date() >= this.expiresAt;\n  }\n\n  /**\n   * Check if the secret can be used (active and not expired)\n   */\n  isUsable(): boolean {\n    return this.isActive() && !this.isExpired();\n  }\n\n  /**\n   * Record an access to this secret\n   */\n  recordAccess(): void {\n    this.lastAccessedAt = new Date();\n    this.accessCount += 1;\n  }\n\n  /**\n   * Disable the secret\n   */\n  disable(): void {\n    this.status = 'disabled';\n  }\n\n  /**\n   * Enable the secret\n   */\n  enable(): void {\n    this.status = 'active';\n  }\n}\n","/**\n * TenantKey model - Tracks per-tenant Data Encryption Keys (TDEKs)\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Key status values\n */\nexport type TenantKeyStatus = 'active' | 'rotating' | 'retired' | 'compromised';\n\n/**\n * Constructor options for {@link TenantKey}. Each field is optional and mirrors\n * a persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface TenantKeyOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  wrappedKey?: string;\n  amkKeyId?: string;\n  status?: TenantKeyStatus;\n  version?: number;\n  rotateAfter?: Date | string | number | null;\n  retiredAt?: Date | string | number | null;\n}\n\n/**\n * TenantKey tracks the per-tenant Data Encryption Keys (TDEKs).\n *\n * Each tenant has one or more TDEKs stored in wrapped form. The wrapped key\n * can only be decrypted using the Application Master Key (AMK).\n *\n * **Key Lifecycle**:\n * 1. `active` - Current key used for encryption\n * 2. `rotating` - Transitional state during rotation\n * 3. `retired` - Old key kept for decryption of existing secrets\n * 4. `compromised` - Key marked as compromised, should not be used\n *\n * **Note**: This model is NOT tenant-scoped itself because it tracks\n * keys FOR tenants, not secrets owned BY tenants.\n *\n * @example\n * ```typescript\n * // Get active key for a tenant\n * const key = await tenantKeys.get({\n *   tenantId: 'tenant-123',\n *   status: 'active'\n * });\n *\n * // List all key versions for a tenant\n * const versions = await tenantKeys.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'version DESC'\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `TenantKey` is deliberately NOT tenant-scoped — neither via the decorator nor via\n// `tenantScoped: true` on `@smrt()`. The row carries a `tenantId` column because each\n// TDEK belongs to a tenant, but the model itself must remain queryable across tenants\n// (e.g. cross-tenant key-rotation tooling, AMK rewrap jobs, super-admin auditing).\n// Adding the tenancy interceptor here would silently filter out keys the rotation\n// service needs to inspect. See `packages/secrets/CLAUDE.md` \"Known exceptions to\n// monorepo standards\" for the full rationale.\n@smrt({\n  // NOT tenant-scoped - this model tracks keys FOR tenants\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for key-rotation tooling and audit; HTTP exposure is\n  // intentionally excluded, so skipApiCheck acknowledges the divergence.\n  cli: { include: ['list', 'get'], skipApiCheck: true },\n})\nexport class TenantKey extends SmrtObject {\n  /**\n   * Tenant ID this key belongs to\n   */\n  tenantId: string = '';\n\n  /**\n   * Wrapped key data (format: wrappedKey:iv:authTag)\n   */\n  wrappedKey: string = '';\n\n  /**\n   * ID of the AMK used to wrap this key\n   */\n  amkKeyId: string = '';\n\n  /**\n   * Current status of the key\n   */\n  status: TenantKeyStatus = 'active';\n\n  /**\n   * Version number (increments on rotation)\n   */\n  version: number = 1;\n\n  /**\n   * Recommended rotation date\n   */\n  rotateAfter: Date | null = null;\n\n  /**\n   * When the key was retired (if applicable)\n   */\n  retiredAt: Date | null = null;\n\n  constructor(options: TenantKeyOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.wrappedKey !== undefined) this.wrappedKey = options.wrappedKey;\n    if (options.amkKeyId !== undefined) this.amkKeyId = options.amkKeyId;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.version !== undefined) this.version = options.version;\n    if (options.rotateAfter !== undefined) {\n      this.rotateAfter =\n        options.rotateAfter instanceof Date\n          ? options.rotateAfter\n          : options.rotateAfter\n            ? new Date(options.rotateAfter)\n            : null;\n    }\n    if (options.retiredAt !== undefined) {\n      this.retiredAt =\n        options.retiredAt instanceof Date\n          ? options.retiredAt\n          : options.retiredAt\n            ? new Date(options.retiredAt)\n            : null;\n    }\n  }\n\n  /**\n   * Check if this key is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if this key needs rotation\n   */\n  needsRotation(): boolean {\n    if (!this.rotateAfter) return false;\n    return new Date() >= this.rotateAfter;\n  }\n\n  /**\n   * Check if this key is retired\n   */\n  isRetired(): boolean {\n    return this.status === 'retired';\n  }\n\n  /**\n   * Check if this key is compromised\n   */\n  isCompromised(): boolean {\n    return this.status === 'compromised';\n  }\n\n  /**\n   * Check if this key can be used for decryption\n   * (active or retired keys can decrypt)\n   */\n  canDecrypt(): boolean {\n    return this.status === 'active' || this.status === 'retired';\n  }\n\n  /**\n   * Check if this key can be used for encryption\n   * (only active keys should encrypt)\n   */\n  canEncrypt(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Mark this key as retired\n   */\n  retire(): void {\n    this.status = 'retired';\n    this.retiredAt = new Date();\n  }\n\n  /**\n   * Mark this key as compromised\n   */\n  markCompromised(): void {\n    this.status = 'compromised';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;ACuGO,IAAA,iBAAA,MAAM,uBAAuB,WAAW;;;;CAI7C,WAA0B;;;;CAK1B,WAC0B;;;;CAK1B,aAAqB;;;;;;;CAQrB,SACwB;;;;CAKxB,SAA4B;;;;CAK5B,SAA4B;;;;CAK5B,YAAoB;;;;CAKpB,YAAoB;;;;CAKpB,UAAmC,CAAC;CAEpC,YAAY,UAAiC,CAAC,GAAG;EAC/C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GACvB,KAAK,WAAW,QAAQ;EAE1B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC5D;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,eAAwB;EACtB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO;GAAC;GAAU;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,MAAM;CAC5D;;;;CAKA,iBAA0B;EACxB,OAAO,KAAK,WAAW;CACzB;AACF;YAlGG,WAAW,QAAQ,CAAA,GAAA,eAAA,WAAA,YAAA,KAAA,CAAA;YAcnB,gBAAgB,gCAAgC,CAAA,GAAA,eAAA,WAAA,UAAA,KAAA,CAAA;6BA/BlD,KAAK;CACJ,cAAc;CACd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,cAAA;;;;AAiHD,SAAgB,iBAAiB,QAUG;CAClC,MAAM,WACJ,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa,WACjD,OACA,OAAO;CAMb,MAAM,SACJ,OAAO,UAAU,QACjB,OAAO,WAAW,YAClB,OAAO,WAAW,KACd,OACA,OAAO;CAab,OAAO;EAVL,UAAU,OAAO,YAAY;EAC7B,YAAY,OAAO;EACnB;EACA,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,WAAW,OAAO,aAAa;EAC/B,WAAW,OAAO,aAAa;EAC/B,SAAS,OAAO,WAAW,CAAC;EAC5B;CAEK;AACT;;;AChLO,IAAA,SAAA,MAAM,eAAe,WAAW;;;;CAIrC,WAAmB;;;;CAKnB,OAAe;;;;CAKf,cAAsB;;;;CAKtB,WAAmB;;;;CAKnB,iBAAyB;;;;CAKzB,aAAqB;;;;CAKrB,SAAuB;;;;CAKvB,YAAyB;;;;CAKzB,iBAA8B;;;;CAK9B,cAAsB;;;;CAKtB,WAAoC,CAAC;CAErC,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,SAAS,KAAA,GAAW,KAAK,OAAO,QAAQ;EACpD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBAAiB,QAAQ;EAChC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;EAEV,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBACH,QAAQ,0BAA0B,OAC9B,QAAQ,iBACR,QAAQ,iBACN,IAAI,KAAK,QAAQ,cAAc,IAC/B;EAEV,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,IAAI,CAAC,KAAK,WAAW,OAAO;EAC5B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,SAAS,KAAK,CAAC,KAAK,UAAU;CAC5C;;;;CAKA,eAAqB;EACnB,KAAK,iCAAiB,IAAI,KAAK;EAC/B,KAAK,eAAe;CACtB;;;;CAKA,UAAgB;EACd,KAAK,SAAS;CAChB;;;;CAKA,SAAe;EACb,KAAK,SAAS;CAChB;AACF;qBA5IC,KAAK;CACJ,cAAc;CAEd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,MAAA;;;ACHM,IAAA,YAAA,MAAM,kBAAkB,WAAW;;;;CAIxC,WAAmB;;;;CAKnB,aAAqB;;;;CAKrB,WAAmB;;;;CAKnB,SAA0B;;;;CAK1B,UAAkB;;;;CAKlB,cAA2B;;;;CAK3B,YAAyB;CAEzB,YAAY,UAA4B,CAAC,GAAG;EAC1C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;EAC1D,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cACH,QAAQ,uBAAuB,OAC3B,QAAQ,cACR,QAAQ,cACN,IAAI,KAAK,QAAQ,WAAW,IAC5B;EAEV,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;CAEZ;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,IAAI,CAAC,KAAK,aAAa,OAAO;EAC9B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO,KAAK,WAAW;CACzB;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW;CACrD;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,SAAe;EACb,KAAK,SAAS;EACd,KAAK,4BAAY,IAAI,KAAK;CAC5B;;;;CAKA,kBAAwB;EACtB,KAAK,SAAS;CAChB;AACF;wBAhIC,KAAK;CAEJ,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,QAAQ,KAAK;EAAG,cAAc;CAAK;AACtD,CAAC,CAAA,GAAA,SAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
-import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./chunks/TenantKey-CITvBEjb.js";
-import { a as SecretAuditLogCollection, i as SecretCollection, n as SecretService, r as TenantKeyCollection, t as SecretKeyDriftError } from "./chunks/SecretService-DUs_3N0R.js";
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./chunks/TenantKey-COz54GJ_.js";
+import { a as SecretAuditLogCollection, i as SecretCollection, n as SecretService, r as TenantKeyCollection, t as SecretKeyDriftError } from "./chunks/SecretService-DLAqn4zS.js";
 import { AMKUnavailableError, DecryptionError, EncryptionError, InvalidKeyFormatError, KeyNotFoundError, KeyRotationError, SecretError, StoreNotInitializedError, TenantKeyMissingError } from "@happyvertical/secrets";
 //#region src/index.ts
 /** @internal */

package/dist/manifest.json

@@ -1,8 +1,8 @@
 {
   "version": "1.0.0",
-  "timestamp": 1783059768211,
+  "timestamp": 1783100574298,
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.37.8",
+  "packageVersion": "0.37.10",
   "objects": {
     "@happyvertical/smrt-secrets:SecretAuditLogCollection": {
       "name": "secretauditlogcollection",

package/dist/models/index.js

@@ -1,2 +1,2 @@
-import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "../chunks/TenantKey-CITvBEjb.js";
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "../chunks/TenantKey-COz54GJ_.js";
 export { Secret, SecretAuditLog, TenantKey, createAuditEntry };

package/dist/services/SecretService.js

@@ -1,2 +1,2 @@
-import { n as SecretService, t as SecretKeyDriftError } from "../chunks/SecretService-DUs_3N0R.js";
+import { n as SecretService, t as SecretKeyDriftError } from "../chunks/SecretService-DLAqn4zS.js";
 export { SecretKeyDriftError, SecretService };

package/dist/smrt-knowledge.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-07-03T06:22:48.436Z",
+  "generatedAt": "2026-07-03T17:42:54.588Z",
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.37.8",
+  "packageVersion": "0.37.10",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "d5b3e904781eace1707fce2447b37b2b29360885b8a1700832b3c65653790836",
-    "packageJson": "b3d5da129ef0aecb450f3843daae4f3628609d1c9562ee138d303e58acd5fcfb",
+    "manifest": "9c720fb85e56274013bb44afbfbe846faec7c2320259d89407f50f2ed9e36a83",
+    "packageJson": "3ba61fbeb4bbdddff50f93d0e341887f57091dd12b54ec5c82657c13b1cfbd22",
     "agents": "c2be546ffbe79a0df95401c10a60e23f4f31cb8232cb1349fcdb7e5682852d4a"
   },
   "exports": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-secrets",
-  "version": "0.37.8",
+  "version": "0.37.10",
   "description": "Per-tenant secret management with envelope encryption for SMRT",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,15 +31,15 @@
     "@happyvertical/secrets": "^0.74.11",
     "@happyvertical/sql": "^0.74.11",
     "@happyvertical/utils": "^0.74.11",
-    "@happyvertical/smrt-core": "0.37.8",
-    "@happyvertical/smrt-tenancy": "0.37.8"
+    "@happyvertical/smrt-core": "0.37.10",
+    "@happyvertical/smrt-tenancy": "0.37.10"
   },
   "devDependencies": {
     "@types/node": "24.13.2",
     "typescript": "^5.9.3",
     "vite": "^8.1.2",
     "vitest": "^4.1.9",
-    "@happyvertical/smrt-vitest": "0.37.8"
+    "@happyvertical/smrt-vitest": "0.37.10"
   },
   "keywords": [
     "smrt",