@happyvertical/smrt-secrets 0.40.64 → 0.40.66

package/dist/smrt-knowledge.json

@@ -1,13 +1,14 @@
 {
   "schemaVersion": 1,
+  "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.40.64",
+  "packageVersion": "0.40.66",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "5bfa42e8d42b2bc83c3b7cf98cf2e57f7132ab1a451a4a0441bec1af3c8332bc",
-    "packageJson": "807c504bd77cdd91b7dcdc02b7fb48f4f639bef4dd5dbfa9d9feea1fb0d35f1f",
+    "manifest": "3c59ec684f5d80e87e16d95be4201f4579d7df4b5faf0f1f994d567820134ca0",
+    "packageJson": "d7e067a4b8b689bff9a985129037a8897bd72bb797b6f90753fc698f632edcde",
     "agents": "c2be546ffbe79a0df95401c10a60e23f4f31cb8232cb1349fcdb7e5682852d4a"
   },
   "exports": [
@@ -63,6 +64,80 @@
         "getUserActivity",
         "listLogs"
       ],
+      "methodSignatures": [
+        {
+          "name": "cleanup",
+          "async": true,
+          "params": [
+            "olderThanDays?: number"
+          ],
+          "returns": "Promise<number>"
+        },
+        {
+          "name": "countByAction",
+          "async": true,
+          "params": [
+            "tenantId: string | null",
+            "since?: Date"
+          ],
+          "returns": "Promise<Record<SecretAuditAction, number>>"
+        },
+        {
+          "name": "countByResult",
+          "async": true,
+          "params": [
+            "tenantId: string | null",
+            "since?: Date"
+          ],
+          "returns": "Promise<Record<SecretAuditResult, number>>"
+        },
+        {
+          "name": "getRecentDenials",
+          "async": true,
+          "params": [
+            "tenantId: string | null",
+            "limit?: number"
+          ],
+          "returns": "Promise<SecretAuditLog[]>"
+        },
+        {
+          "name": "getRecentFailures",
+          "async": true,
+          "params": [
+            "tenantId: string | null",
+            "limit?: number"
+          ],
+          "returns": "Promise<SecretAuditLog[]>"
+        },
+        {
+          "name": "getSecretHistory",
+          "async": true,
+          "params": [
+            "tenantId: string | null",
+            "secretName: string",
+            "limit?: number"
+          ],
+          "returns": "Promise<SecretAuditLog[]>"
+        },
+        {
+          "name": "getUserActivity",
+          "async": true,
+          "params": [
+            "tenantId: string | null",
+            "userId: string",
+            "limit?: number"
+          ],
+          "returns": "Promise<SecretAuditLog[]>"
+        },
+        {
+          "name": "listLogs",
+          "async": true,
+          "params": [
+            "options?: ListAuditLogsOptions"
+          ],
+          "returns": "Promise<SecretAuditLog[]>"
+        }
+      ],
       "surfaces": [],
       "relationshipFeatures": [
         "uuidColumns"
@@ -89,6 +164,77 @@
         "listExpiring",
         "listSecrets"
       ],
+      "methodSignatures": [
+        {
+          "name": "countByStatus",
+          "async": true,
+          "params": [
+            "tenantId: string"
+          ],
+          "returns": "Promise<Record<SecretStatus, number>>"
+        },
+        {
+          "name": "deleteByName",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "name: string"
+          ],
+          "returns": "Promise<boolean>"
+        },
+        {
+          "name": "findByName",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "name: string"
+          ],
+          "returns": "Promise<Secret | null>"
+        },
+        {
+          "name": "getCategories",
+          "async": true,
+          "params": [
+            "tenantId: string"
+          ],
+          "returns": "Promise<string[]>"
+        },
+        {
+          "name": "listActive",
+          "async": true,
+          "params": [
+            "tenantId: string"
+          ],
+          "returns": "Promise<Secret[]>"
+        },
+        {
+          "name": "listByCategory",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "category: string"
+          ],
+          "returns": "Promise<Secret[]>"
+        },
+        {
+          "name": "listExpiring",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "daysAhead?: number"
+          ],
+          "returns": "Promise<Secret[]>"
+        },
+        {
+          "name": "listSecrets",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "options?: ListSecretsOptions"
+          ],
+          "returns": "Promise<Secret[]>"
+        }
+      ],
       "surfaces": [],
       "relationshipFeatures": [
         "uuidColumns"
@@ -115,6 +261,65 @@
         "listKeyVersions",
         "markCompromised"
       ],
+      "methodSignatures": [
+        {
+          "name": "cleanupRetiredKeys",
+          "async": true,
+          "params": [
+            "olderThanDays?: number"
+          ],
+          "returns": "Promise<number>"
+        },
+        {
+          "name": "countByStatus",
+          "async": true,
+          "returns": "Promise<Record<TenantKeyStatus, number>>"
+        },
+        {
+          "name": "findKeysNeedingRotation",
+          "async": true,
+          "returns": "Promise<TenantKey[]>"
+        },
+        {
+          "name": "getActiveKey",
+          "async": true,
+          "params": [
+            "tenantId: string"
+          ],
+          "returns": "Promise<TenantKey | null>"
+        },
+        {
+          "name": "getKeyVersion",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "version: number"
+          ],
+          "returns": "Promise<TenantKey | null>"
+        },
+        {
+          "name": "listAllActiveKeys",
+          "async": true,
+          "returns": "Promise<TenantKey[]>"
+        },
+        {
+          "name": "listKeyVersions",
+          "async": true,
+          "params": [
+            "tenantId: string"
+          ],
+          "returns": "Promise<TenantKey[]>"
+        },
+        {
+          "name": "markCompromised",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "keyId: string"
+          ],
+          "returns": "Promise<boolean>"
+        }
+      ],
       "surfaces": [],
       "relationshipFeatures": [
         "uuidColumns"
@@ -134,43 +339,50 @@
           "name": "tenantId",
           "type": "text",
           "required": false,
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "default": ""
         },
         {
           "name": "name",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "description",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "category",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "encryptedValue",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "keyVersion",
           "type": "integer",
           "required": false,
-          "columnType": "INTEGER"
+          "columnType": "INTEGER",
+          "default": 1
         },
         {
           "name": "status",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": "active"
         },
         {
           "name": "expiresAt",
@@ -188,13 +400,15 @@
           "name": "accessCount",
           "type": "integer",
           "required": false,
-          "columnType": "INTEGER"
+          "columnType": "INTEGER",
+          "default": 0
         },
         {
           "name": "metadata",
           "type": "json",
           "required": false,
-          "columnType": "JSON"
+          "columnType": "JSON",
+          "default": {}
         }
       ],
       "relationships": [],
@@ -206,6 +420,37 @@
         "isUsable",
         "recordAccess"
       ],
+      "methodSignatures": [
+        {
+          "name": "disable",
+          "returns": "void"
+        },
+        {
+          "name": "enable",
+          "returns": "void"
+        },
+        {
+          "name": "isActive",
+          "returns": "boolean"
+        },
+        {
+          "name": "isExpired",
+          "returns": "boolean"
+        },
+        {
+          "name": "isUsable",
+          "returns": "boolean"
+        },
+        {
+          "name": "recordAccess",
+          "returns": "void"
+        }
+      ],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
       "surfaces": [
         {
           "kind": "cli",
@@ -245,7 +490,8 @@
           "name": "secretName",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "userId",
@@ -258,31 +504,36 @@
           "name": "action",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": "read"
         },
         {
           "name": "result",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": "success"
         },
         {
           "name": "ipAddress",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "userAgent",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "details",
           "type": "json",
           "required": false,
-          "columnType": "JSON"
+          "columnType": "JSON",
+          "default": {}
         }
       ],
       "relationships": [
@@ -309,6 +560,37 @@
         "isSuccess",
         "isWriteAction"
       ],
+      "methodSignatures": [
+        {
+          "name": "isDenied",
+          "returns": "boolean"
+        },
+        {
+          "name": "isFailure",
+          "returns": "boolean"
+        },
+        {
+          "name": "isKeyOperation",
+          "returns": "boolean"
+        },
+        {
+          "name": "isReadAction",
+          "returns": "boolean"
+        },
+        {
+          "name": "isSuccess",
+          "returns": "boolean"
+        },
+        {
+          "name": "isWriteAction",
+          "returns": "boolean"
+        }
+      ],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
       "surfaces": [
         {
           "kind": "cli",
@@ -337,31 +619,36 @@
           "name": "tenantId",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "wrappedKey",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "amkKeyId",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": ""
         },
         {
           "name": "status",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "default": "active"
         },
         {
           "name": "version",
           "type": "integer",
           "required": false,
-          "columnType": "INTEGER"
+          "columnType": "INTEGER",
+          "default": 1
         },
         {
           "name": "rotateAfter",
@@ -387,6 +674,40 @@
         "needsRotation",
         "retire"
       ],
+      "methodSignatures": [
+        {
+          "name": "canDecrypt",
+          "returns": "boolean"
+        },
+        {
+          "name": "canEncrypt",
+          "returns": "boolean"
+        },
+        {
+          "name": "isActive",
+          "returns": "boolean"
+        },
+        {
+          "name": "isCompromised",
+          "returns": "boolean"
+        },
+        {
+          "name": "isRetired",
+          "returns": "boolean"
+        },
+        {
+          "name": "markCompromised",
+          "returns": "void"
+        },
+        {
+          "name": "needsRotation",
+          "returns": "boolean"
+        },
+        {
+          "name": "retire",
+          "returns": "void"
+        }
+      ],
       "surfaces": [
         {
           "kind": "cli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-secrets",
-  "version": "0.40.64",
+  "version": "0.40.66",
   "description": "Per-tenant secret management with envelope encryption for SMRT",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,19 +27,19 @@
     }
   },
   "dependencies": {
-    "@happyvertical/logger": "^0.86.1",
-    "@happyvertical/secrets": "^0.86.1",
-    "@happyvertical/sql": "^0.86.1",
-    "@happyvertical/utils": "^0.86.1",
-    "@happyvertical/smrt-core": "0.40.64",
-    "@happyvertical/smrt-tenancy": "0.40.64"
+    "@happyvertical/logger": "^0.86.3",
+    "@happyvertical/secrets": "^0.86.3",
+    "@happyvertical/sql": "^0.86.3",
+    "@happyvertical/utils": "^0.86.3",
+    "@happyvertical/smrt-core": "0.40.66",
+    "@happyvertical/smrt-tenancy": "0.40.66"
   },
   "devDependencies": {
     "@types/node": "24.13.2",
     "typescript": "5.9.3",
     "vite": "8.1.4",
     "vitest": "4.1.10",
-    "@happyvertical/smrt-vitest": "0.40.64"
+    "@happyvertical/smrt-vitest": "0.40.66"
   },
   "keywords": [
     "smrt",

package/dist/chunks/TenantKey-B7LnzyOd.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"TenantKey-B7LnzyOd.js","names":[],"sources":["../../src/__smrt-register__.ts","../../src/models/SecretAuditLog.ts","../../src/models/Secret.ts","../../src/models/TenantKey.ts"],"sourcesContent":["/**\n * Self-registers this package's build-time manifest before any @smrt() decorator\n * in the package fires. Fixes issue #1132: in consumer runtimes (tsx, SvelteKit\n * SSR, plain `vite dev`) the decorator's synchronous manifest lookup previously\n * missed because no step populated the global manifest cache — classes got\n * registered with zero fields and `save()` / `toJSON()` silently dropped every\n * declared property.\n *\n * Import this module as the first statement in `src/index.ts` so its top-level\n * side effect runs ahead of any class module's @smrt() decorator.\n *\n * Silent no-op in dev/test, where the vitest plugin already populates manifests\n * via a different path. Only needs to succeed in the published dist output.\n *\n * @see https://github.com/happyvertical/smrt/issues/1132\n */\nimport { ObjectRegistry } from '@happyvertical/smrt-core';\n\n// During library builds, smrtPlugin replaces this entire module with generated\n// code that embeds the scanned manifest inline (#1506/#1507) — published dists\n// never resolve this URL, so downstream bundlers cannot break registration by\n// relocating the compiled module away from dist/manifest.json. The runtime\n// lookup below is the fallback for source-mode runs without that transform.\nObjectRegistry.registerPackageManifest(\n  new URL('./manifest.json', import.meta.url),\n);\n","/**\n * SecretAuditLog model - Audit trail for secret operations\n * @packageDocumentation\n */\n\nimport type {\n  SmrtCreateInput,\n  SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\n\n/**\n * Secret audit action types\n */\nexport type SecretAuditAction =\n  | 'create'\n  | 'read'\n  | 'update'\n  | 'delete'\n  | 'rotate_key'\n  | 'disable'\n  | 'enable'\n  | 'expire';\n\n/**\n * Audit result types\n */\nexport type SecretAuditResult = 'success' | 'failure' | 'denied';\n\n/**\n * Constructor options for {@link SecretAuditLog}. Each field is optional and\n * mirrors a persisted column.\n */\nexport interface SecretAuditLogOptions extends SmrtObjectOptions {\n  tenantId?: string | null;\n  secretId?: string | null;\n  secretName?: string;\n  userId?: string | null;\n  action?: SecretAuditAction;\n  result?: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}\n\n/**\n * SecretAuditLog records all operations on secrets for compliance\n * and security monitoring.\n *\n * Every secret operation (create, read, update, delete, key rotation)\n * is logged with the user, action, result, and relevant details.\n *\n * **Retention**: Audit logs should be retained according to your\n * compliance requirements (typically 1-7 years).\n *\n * @example\n * ```typescript\n * // Query recent audit logs\n * const logs = await auditLogs.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'created_at DESC',\n *   limit: 100\n * });\n *\n * // Filter by action\n * const reads = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     action: 'read'\n *   }\n * });\n *\n * // Filter by secret name\n * const apiKeyLogs = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     secretName: 'stripe-api-key'\n *   }\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `SecretAuditLog` uses the inline `tenantScoped: true` form on `@smrt()` rather than\n// the dedicated `@TenantScoped` decorator. Audit-trail queries are read-mostly and run\n// in mixed contexts — under a tenant for tenant-scoped reports, and (prospectively)\n// under super-admin bypass for compliance review. Cross-tenant audit queries should\n// be wrapped in `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy` at the\n// call site; this package has no such call sites today, so the pattern is\n// prescriptive guidance for compliance tooling rather than current practice. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for compliance review; HTTP exposure is intentionally\n  // excluded, so skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true },\n})\nexport class SecretAuditLog extends SmrtObject {\n  /**\n   * Tenant associated with the audited secret operation.\n   */\n  tenantId: string | null = null;\n\n  /**\n   * ID of the secret (may be null for deleted secrets)\n   */\n  @foreignKey('Secret')\n  secretId: string | null = null;\n\n  /**\n   * Name of the secret at the time of the operation\n   */\n  secretName: string = '';\n\n  /**\n   * ID of the user who performed the action, or `null` for system-initiated\n   * operations with no authenticated user. Stored as a native `uuid` column on\n   * Postgres, so a non-UUID actor sentinel must never reach it —\n   * {@link createAuditEntry} normalizes the `'system'` sentinel to null (#1444).\n   */\n  @crossPackageRef('@happyvertical/smrt-users:User')\n  userId: string | null = null;\n\n  /**\n   * The action that was performed\n   */\n  action: SecretAuditAction = 'read';\n\n  /**\n   * Result of the operation\n   */\n  result: SecretAuditResult = 'success';\n\n  /**\n   * IP address of the client (if available)\n   */\n  ipAddress: string = '';\n\n  /**\n   * User agent string (if available)\n   */\n  userAgent: string = '';\n\n  /**\n   * Additional context about the operation\n   */\n  details: Record<string, unknown> = {};\n\n  constructor(options: SecretAuditLogOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) {\n      this.tenantId = options.tenantId;\n    }\n    if (options.secretId !== undefined) this.secretId = options.secretId;\n    if (options.secretName !== undefined) this.secretName = options.secretName;\n    if (options.userId !== undefined) this.userId = options.userId;\n    if (options.action !== undefined) this.action = options.action;\n    if (options.result !== undefined) this.result = options.result;\n    if (options.ipAddress !== undefined) this.ipAddress = options.ipAddress;\n    if (options.userAgent !== undefined) this.userAgent = options.userAgent;\n    if (options.details !== undefined) this.details = options.details;\n  }\n\n  /**\n   * Check if this was a successful operation\n   */\n  isSuccess(): boolean {\n    return this.result === 'success';\n  }\n\n  /**\n   * Check if this was a failed operation\n   */\n  isFailure(): boolean {\n    return this.result === 'failure';\n  }\n\n  /**\n   * Check if this was a denied operation (permission denied)\n   */\n  isDenied(): boolean {\n    return this.result === 'denied';\n  }\n\n  /**\n   * Check if this is a read operation\n   */\n  isReadAction(): boolean {\n    return this.action === 'read';\n  }\n\n  /**\n   * Check if this is a write operation (create, update, delete)\n   */\n  isWriteAction(): boolean {\n    return ['create', 'update', 'delete'].includes(this.action);\n  }\n\n  /**\n   * Check if this is a key operation\n   */\n  isKeyOperation(): boolean {\n    return this.action === 'rotate_key';\n  }\n}\n\n/**\n * Create an audit log entry for a secret operation\n */\nexport function createAuditEntry(params: {\n  secretId?: string | null;\n  secretName: string;\n  tenantId?: string | null;\n  userId?: string | null;\n  action: SecretAuditAction;\n  result: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}): SmrtCreateInput<SecretAuditLog> {\n  const tenantId =\n    params.tenantId === undefined || params.tenantId === 'system'\n      ? null\n      : params.tenantId;\n\n  // The `userId` column is a native `uuid` on Postgres. A missing actor and the\n  // `'system'`/empty sentinels are not valid UUIDs, so normalize them all to\n  // null — a system-initiated operation has no authenticated user. Callers may\n  // pass `null`/`undefined` directly to express that (#1444).\n  const userId =\n    params.userId == null || params.userId === 'system' || params.userId === ''\n      ? null\n      : params.userId;\n\n  const entry: SmrtCreateInput<SecretAuditLog> = {\n    secretId: params.secretId ?? null,\n    secretName: params.secretName,\n    userId,\n    action: params.action,\n    result: params.result,\n    ipAddress: params.ipAddress ?? '',\n    userAgent: params.userAgent ?? '',\n    details: params.details ?? {},\n    tenantId,\n  };\n  return entry;\n}\n","/**\n * Secret model - Tenant-scoped encrypted secrets storage\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Secret status values\n */\nexport type SecretStatus = 'active' | 'disabled' | 'expired';\n\n/**\n * Constructor options for {@link Secret}. Each field is optional and mirrors a\n * persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface SecretOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  name?: string;\n  description?: string;\n  category?: string;\n  encryptedValue?: string;\n  keyVersion?: number;\n  status?: SecretStatus;\n  expiresAt?: Date | string | number | null;\n  lastAccessedAt?: Date | string | number | null;\n  accessCount?: number;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Secret represents an encrypted value stored per-tenant.\n *\n * Secrets are tenant-scoped and use envelope encryption:\n * - Each tenant has their own Data Encryption Key (TDEK)\n * - The TDEK is wrapped by the Application Master Key (AMK)\n * - Secret values are encrypted by the unwrapped TDEK\n *\n * **Security**: This model deliberately excludes API and MCP exposure\n * to prevent accidental secret leakage. Secrets are only accessible\n * via CLI commands or direct service calls.\n *\n * @example\n * ```typescript\n * import { SecretService } from '@happyvertical/smrt-secrets';\n *\n * const service = await SecretService.create({ db });\n *\n * await withTenant({ tenantId: 'tenant-123' }, async () => {\n *   // Store a secret\n *   await service.store('api-key', 'sk_live_xxx', { category: 'stripe' });\n *\n *   // Retrieve (auto-decrypts)\n *   const apiKey = await service.retrieve('api-key');\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `Secret` uses the inline `tenantScoped: true` form on `@smrt()` rather than the\n// dedicated `@TenantScoped` decorator from `@happyvertical/smrt-tenancy`. The boolean\n// form gives us required-mode tenant scoping without depending on the tenancy package\n// at the model layer, while `SecretService` performs manual scoping by setting\n// `context = tenantId` on each row. The `(slug, context)` upsert key derived from the\n// base `SmrtObject` fields is what gives different tenants isolated namespaces for\n// secret names — switching to the decorator without changing the upsert key would\n// surface false-positive name collisions across tenants. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  // NO API or MCP exposure for security\n  api: { include: [] },\n  mcp: { include: [] },\n  // CLI runs in-process; secrets must never be reachable over HTTP, so\n  // skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true }, // Only list names, not values\n})\nexport class Secret extends SmrtObject {\n  /**\n   * Tenant that owns this secret. Also stored in context for per-tenant name uniqueness.\n   */\n  tenantId: string = '';\n\n  /**\n   * Unique name for the secret within the tenant\n   */\n  name: string = '';\n\n  /**\n   * Human-readable description\n   */\n  description: string = '';\n\n  /**\n   * Category for organization (e.g., 'database', 'api-key', 'oauth')\n   */\n  category: string = '';\n\n  /**\n   * JSON-encoded EncryptedEnvelope from @happyvertical/secrets\n   */\n  encryptedValue: string = '';\n\n  /**\n   * Version of the tenant key used to encrypt this secret\n   */\n  keyVersion: number = 1;\n\n  /**\n   * Current status of the secret\n   */\n  status: SecretStatus = 'active';\n\n  /**\n   * Optional expiration date\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * Last time this secret was accessed (decrypted)\n   */\n  lastAccessedAt: Date | null = null;\n\n  /**\n   * Number of times this secret has been accessed\n   */\n  accessCount: number = 0;\n\n  /**\n   * Additional metadata stored with the secret\n   */\n  metadata: Record<string, unknown> = {};\n\n  constructor(options: SecretOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.name !== undefined) this.name = options.name;\n    if (options.description !== undefined)\n      this.description = options.description;\n    if (options.category !== undefined) this.category = options.category;\n    if (options.encryptedValue !== undefined)\n      this.encryptedValue = options.encryptedValue;\n    if (options.keyVersion !== undefined) this.keyVersion = options.keyVersion;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.expiresAt !== undefined) {\n      this.expiresAt =\n        options.expiresAt instanceof Date\n          ? options.expiresAt\n          : options.expiresAt\n            ? new Date(options.expiresAt)\n            : null;\n    }\n    if (options.lastAccessedAt !== undefined) {\n      this.lastAccessedAt =\n        options.lastAccessedAt instanceof Date\n          ? options.lastAccessedAt\n          : options.lastAccessedAt\n            ? new Date(options.lastAccessedAt)\n            : null;\n    }\n    if (options.accessCount !== undefined)\n      this.accessCount = options.accessCount;\n    if (options.metadata !== undefined) this.metadata = options.metadata;\n  }\n\n  /**\n   * Check if the secret is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if the secret has expired\n   */\n  isExpired(): boolean {\n    if (!this.expiresAt) return false;\n    return new Date() >= this.expiresAt;\n  }\n\n  /**\n   * Check if the secret can be used (active and not expired)\n   */\n  isUsable(): boolean {\n    return this.isActive() && !this.isExpired();\n  }\n\n  /**\n   * Record an access to this secret\n   */\n  recordAccess(): void {\n    this.lastAccessedAt = new Date();\n    this.accessCount += 1;\n  }\n\n  /**\n   * Disable the secret\n   */\n  disable(): void {\n    this.status = 'disabled';\n  }\n\n  /**\n   * Enable the secret\n   */\n  enable(): void {\n    this.status = 'active';\n  }\n}\n","/**\n * TenantKey model - Tracks per-tenant Data Encryption Keys (TDEKs)\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Key status values\n */\nexport type TenantKeyStatus = 'active' | 'rotating' | 'retired' | 'compromised';\n\n/**\n * Constructor options for {@link TenantKey}. Each field is optional and mirrors\n * a persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface TenantKeyOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  wrappedKey?: string;\n  amkKeyId?: string;\n  status?: TenantKeyStatus;\n  version?: number;\n  rotateAfter?: Date | string | number | null;\n  retiredAt?: Date | string | number | null;\n}\n\n/**\n * TenantKey tracks the per-tenant Data Encryption Keys (TDEKs).\n *\n * Each tenant has one or more TDEKs stored in wrapped form. The wrapped key\n * can only be decrypted using the Application Master Key (AMK).\n *\n * **Key Lifecycle**:\n * 1. `active` - Current key used for encryption\n * 2. `rotating` - Transitional state during rotation\n * 3. `retired` - Old key kept for decryption of existing secrets\n * 4. `compromised` - Key marked as compromised, should not be used\n *\n * **Note**: This model is NOT tenant-scoped itself because it tracks\n * keys FOR tenants, not secrets owned BY tenants.\n *\n * @example\n * ```typescript\n * // Get active key for a tenant\n * const key = await tenantKeys.get({\n *   tenantId: 'tenant-123',\n *   status: 'active'\n * });\n *\n * // List all key versions for a tenant\n * const versions = await tenantKeys.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'version DESC'\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `TenantKey` is deliberately NOT tenant-scoped — neither via the decorator nor via\n// `tenantScoped: true` on `@smrt()`. The row carries a `tenantId` column because each\n// TDEK belongs to a tenant, but the model itself must remain queryable across tenants\n// (e.g. cross-tenant key-rotation tooling, AMK rewrap jobs, super-admin auditing).\n// Adding the tenancy interceptor here would silently filter out keys the rotation\n// service needs to inspect. See `packages/secrets/CLAUDE.md` \"Known exceptions to\n// monorepo standards\" for the full rationale.\n@smrt({\n  // NOT tenant-scoped - this model tracks keys FOR tenants\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for key-rotation tooling and audit; HTTP exposure is\n  // intentionally excluded, so skipApiCheck acknowledges the divergence.\n  cli: { include: ['list', 'get'], skipApiCheck: true },\n})\nexport class TenantKey extends SmrtObject {\n  /**\n   * Tenant ID this key belongs to\n   */\n  tenantId: string = '';\n\n  /**\n   * Wrapped key data (format: wrappedKey:iv:authTag)\n   */\n  wrappedKey: string = '';\n\n  /**\n   * ID of the AMK used to wrap this key\n   */\n  amkKeyId: string = '';\n\n  /**\n   * Current status of the key\n   */\n  status: TenantKeyStatus = 'active';\n\n  /**\n   * Version number (increments on rotation)\n   */\n  version: number = 1;\n\n  /**\n   * Recommended rotation date\n   */\n  rotateAfter: Date | null = null;\n\n  /**\n   * When the key was retired (if applicable)\n   */\n  retiredAt: Date | null = null;\n\n  constructor(options: TenantKeyOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.wrappedKey !== undefined) this.wrappedKey = options.wrappedKey;\n    if (options.amkKeyId !== undefined) this.amkKeyId = options.amkKeyId;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.version !== undefined) this.version = options.version;\n    if (options.rotateAfter !== undefined) {\n      this.rotateAfter =\n        options.rotateAfter instanceof Date\n          ? options.rotateAfter\n          : options.rotateAfter\n            ? new Date(options.rotateAfter)\n            : null;\n    }\n    if (options.retiredAt !== undefined) {\n      this.retiredAt =\n        options.retiredAt instanceof Date\n          ? options.retiredAt\n          : options.retiredAt\n            ? new Date(options.retiredAt)\n            : null;\n    }\n  }\n\n  /**\n   * Check if this key is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if this key needs rotation\n   */\n  needsRotation(): boolean {\n    if (!this.rotateAfter) return false;\n    return new Date() >= this.rotateAfter;\n  }\n\n  /**\n   * Check if this key is retired\n   */\n  isRetired(): boolean {\n    return this.status === 'retired';\n  }\n\n  /**\n   * Check if this key is compromised\n   */\n  isCompromised(): boolean {\n    return this.status === 'compromised';\n  }\n\n  /**\n   * Check if this key can be used for decryption\n   * (active or retired keys can decrypt)\n   */\n  canDecrypt(): boolean {\n    return this.status === 'active' || this.status === 'retired';\n  }\n\n  /**\n   * Check if this key can be used for encryption\n   * (only active keys should encrypt)\n   */\n  canEncrypt(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Mark this key as retired\n   */\n  retire(): void {\n    this.status = 'retired';\n    this.retiredAt = new Date();\n  }\n\n  /**\n   * Mark this key as compromised\n   */\n  markCompromised(): void {\n    this.status = 'compromised';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;ACuGO,IAAA,iBAAA,MAAM,uBAAuB,WAAW;;;;CAI7C,WAA0B;;;;CAK1B,WAC0B;;;;CAK1B,aAAqB;;;;;;;CAQrB,SACwB;;;;CAKxB,SAA4B;;;;CAK5B,SAA4B;;;;CAK5B,YAAoB;;;;CAKpB,YAAoB;;;;CAKpB,UAAmC,CAAC;CAEpC,YAAY,UAAiC,CAAC,GAAG;EAC/C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GACvB,KAAK,WAAW,QAAQ;EAE1B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC5D;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,eAAwB;EACtB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO;GAAC;GAAU;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,MAAM;CAC5D;;;;CAKA,iBAA0B;EACxB,OAAO,KAAK,WAAW;CACzB;AACF;YAlGG,WAAW,QAAQ,CAAA,GAAA,eAAA,WAAA,YAAA,KAAA,CAAA;YAcnB,gBAAgB,gCAAgC,CAAA,GAAA,eAAA,WAAA,UAAA,KAAA,CAAA;6BA/BlD,KAAK;CACJ,cAAc;CACd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,cAAA;;;;AAiHD,SAAgB,iBAAiB,QAUG;CAClC,MAAM,WACJ,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa,WACjD,OACA,OAAO;CAMb,MAAM,SACJ,OAAO,UAAU,QAAQ,OAAO,WAAW,YAAY,OAAO,WAAW,KACrE,OACA,OAAO;CAab,OAAO;EAVL,UAAU,OAAO,YAAY;EAC7B,YAAY,OAAO;EACnB;EACA,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,WAAW,OAAO,aAAa;EAC/B,WAAW,OAAO,aAAa;EAC/B,SAAS,OAAO,WAAW,CAAC;EAC5B;CAEK;AACT;;;AC9KO,IAAA,SAAA,MAAM,eAAe,WAAW;;;;CAIrC,WAAmB;;;;CAKnB,OAAe;;;;CAKf,cAAsB;;;;CAKtB,WAAmB;;;;CAKnB,iBAAyB;;;;CAKzB,aAAqB;;;;CAKrB,SAAuB;;;;CAKvB,YAAyB;;;;CAKzB,iBAA8B;;;;CAK9B,cAAsB;;;;CAKtB,WAAoC,CAAC;CAErC,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,SAAS,KAAA,GAAW,KAAK,OAAO,QAAQ;EACpD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBAAiB,QAAQ;EAChC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;EAEV,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBACH,QAAQ,0BAA0B,OAC9B,QAAQ,iBACR,QAAQ,iBACN,IAAI,KAAK,QAAQ,cAAc,IAC/B;EAEV,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,IAAI,CAAC,KAAK,WAAW,OAAO;EAC5B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,SAAS,KAAK,CAAC,KAAK,UAAU;CAC5C;;;;CAKA,eAAqB;EACnB,KAAK,iCAAiB,IAAI,KAAK;EAC/B,KAAK,eAAe;CACtB;;;;CAKA,UAAgB;EACd,KAAK,SAAS;CAChB;;;;CAKA,SAAe;EACb,KAAK,SAAS;CAChB;AACF;qBA5IC,KAAK;CACJ,cAAc;CAEd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,MAAA;;;ACHM,IAAA,YAAA,MAAM,kBAAkB,WAAW;;;;CAIxC,WAAmB;;;;CAKnB,aAAqB;;;;CAKrB,WAAmB;;;;CAKnB,SAA0B;;;;CAK1B,UAAkB;;;;CAKlB,cAA2B;;;;CAK3B,YAAyB;CAEzB,YAAY,UAA4B,CAAC,GAAG;EAC1C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;EAC1D,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cACH,QAAQ,uBAAuB,OAC3B,QAAQ,cACR,QAAQ,cACN,IAAI,KAAK,QAAQ,WAAW,IAC5B;EAEV,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;CAEZ;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,IAAI,CAAC,KAAK,aAAa,OAAO;EAC9B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO,KAAK,WAAW;CACzB;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW;CACrD;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,SAAe;EACb,KAAK,SAAS;EACd,KAAK,4BAAY,IAAI,KAAK;CAC5B;;;;CAKA,kBAAwB;EACtB,KAAK,SAAS;CAChB;AACF;wBAhIC,KAAK;CAEJ,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,QAAQ,KAAK;EAAG,cAAc;CAAK;AACtD,CAAC,CAAA,GAAA,SAAA"}