@happyvertical/smrt-secrets 0.49.3 → 0.49.4

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.49.3",
+  "packageVersion": "0.49.4",
   "objects": {
     "@happyvertical/smrt-secrets:SecretAuditLogCollection": {
       "name": "secretauditlogcollection",
@@ -220,8 +220,8 @@
       "exportName": "SecretAuditLogCollection",
       "collectionExportName": "SecretAuditLogCollectionCollection",
       "schema": {
-        "tableName": "secret_audit_log_collections",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"secret_audit_log_collections\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp\n);",
+        "tableName": "secret_audit_logs",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"secret_audit_logs\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" UUID,\n  \"secret_id\" UUID,\n  \"secret_name\" TEXT DEFAULT '',\n  \"user_id\" UUID,\n  \"action\" TEXT DEFAULT 'read',\n  \"result\" TEXT DEFAULT 'success',\n  \"ip_address\" TEXT DEFAULT '',\n  \"user_agent\" TEXT DEFAULT '',\n  \"details\" JSON DEFAULT '{}'\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -247,25 +247,94 @@
             "type": "TIMESTAMP",
             "notNull": true,
             "default": "current_timestamp"
+          },
+          "tenant_id": {
+            "type": "UUID",
+            "referenceKind": "tenantId",
+            "notNull": false,
+            "unique": false
+          },
+          "secret_id": {
+            "type": "UUID",
+            "referenceKind": "foreignKey",
+            "notNull": false,
+            "unique": false
+          },
+          "secret_name": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "user_id": {
+            "type": "UUID",
+            "referenceKind": "crossPackageRef",
+            "notNull": false,
+            "unique": false
+          },
+          "action": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": "read"
+          },
+          "result": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": "success"
+          },
+          "ip_address": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "user_agent": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "details": {
+            "type": "JSON",
+            "notNull": false,
+            "unique": false,
+            "default": {}
           }
         },
         "indexes": [
           {
-            "name": "secret_audit_log_collections_slug_context_idx",
+            "name": "secret_audit_logs_slug_context_idx",
             "columns": [
+              "tenant_id",
               "slug",
               "context"
             ],
-            "unique": true
+            "unique": true,
+            "nullsNotDistinct": true
           },
           {
-            "name": "secret_audit_log_collections_created_at_idx",
+            "name": "secret_audit_logs_tenant_id_created_at_idx",
             "columns": [
+              "tenant_id",
               "created_at"
             ]
+          },
+          {
+            "name": "secret_audit_logs_secret_id_idx",
+            "columns": [
+              "secret_id"
+            ]
+          },
+          {
+            "name": "secret_audit_logs_user_id_idx",
+            "columns": [
+              "user_id"
+            ]
           }
         ],
-        "version": "7bb61130"
+        "version": "af0d679d"
       }
     },
     "@happyvertical/smrt-secrets:SecretCollection": {
@@ -421,8 +490,8 @@
       "exportName": "SecretCollection",
       "collectionExportName": "SecretCollectionCollection",
       "schema": {
-        "tableName": "secret_collections",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"secret_collections\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp\n);",
+        "tableName": "secrets",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"secrets\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" UUID,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT DEFAULT '',\n  \"category\" TEXT DEFAULT '',\n  \"encrypted_value\" TEXT DEFAULT '',\n  \"key_version\" INTEGER DEFAULT 1,\n  \"status\" TEXT DEFAULT 'active',\n  \"expires_at\" TIMESTAMP,\n  \"last_accessed_at\" TIMESTAMP,\n  \"access_count\" INTEGER DEFAULT 0,\n  \"metadata\" JSON DEFAULT '{}'\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -448,25 +517,92 @@
             "type": "TIMESTAMP",
             "notNull": true,
             "default": "current_timestamp"
+          },
+          "tenant_id": {
+            "type": "UUID",
+            "referenceKind": "tenantId",
+            "notNull": false,
+            "unique": false
+          },
+          "name": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "description": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "category": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "encrypted_value": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "key_version": {
+            "type": "INTEGER",
+            "notNull": false,
+            "unique": false,
+            "default": 1
+          },
+          "status": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": "active"
+          },
+          "expires_at": {
+            "type": "TIMESTAMP",
+            "notNull": false,
+            "unique": false
+          },
+          "last_accessed_at": {
+            "type": "TIMESTAMP",
+            "notNull": false,
+            "unique": false
+          },
+          "access_count": {
+            "type": "INTEGER",
+            "notNull": false,
+            "unique": false,
+            "default": 0
+          },
+          "metadata": {
+            "type": "JSON",
+            "notNull": false,
+            "unique": false,
+            "default": {}
           }
         },
         "indexes": [
           {
-            "name": "secret_collections_slug_context_idx",
+            "name": "secrets_slug_context_idx",
             "columns": [
+              "tenant_id",
               "slug",
               "context"
             ],
-            "unique": true
+            "unique": true,
+            "nullsNotDistinct": true
           },
           {
-            "name": "secret_collections_created_at_idx",
+            "name": "secrets_tenant_id_created_at_idx",
             "columns": [
+              "tenant_id",
               "created_at"
             ]
           }
         ],
-        "version": "5f18a721"
+        "version": "6298a980"
       }
     },
     "@happyvertical/smrt-secrets:TenantKeyCollection": {
@@ -589,8 +725,8 @@
       "exportName": "TenantKeyCollection",
       "collectionExportName": "TenantKeyCollectionCollection",
       "schema": {
-        "tableName": "tenant_key_collections",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"tenant_key_collections\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp\n);",
+        "tableName": "tenant_keys",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"tenant_keys\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT DEFAULT '',\n  \"wrapped_key\" TEXT DEFAULT '',\n  \"amk_key_id\" TEXT DEFAULT '',\n  \"status\" TEXT DEFAULT 'active',\n  \"version\" INTEGER DEFAULT 1,\n  \"rotate_after\" TIMESTAMP,\n  \"retired_at\" TIMESTAMP\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -616,11 +752,51 @@
             "type": "TIMESTAMP",
             "notNull": true,
             "default": "current_timestamp"
+          },
+          "tenant_id": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "wrapped_key": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "amk_key_id": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": ""
+          },
+          "status": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false,
+            "default": "active"
+          },
+          "version": {
+            "type": "INTEGER",
+            "notNull": false,
+            "unique": false,
+            "default": 1
+          },
+          "rotate_after": {
+            "type": "TIMESTAMP",
+            "notNull": false,
+            "unique": false
+          },
+          "retired_at": {
+            "type": "TIMESTAMP",
+            "notNull": false,
+            "unique": false
           }
         },
         "indexes": [
           {
-            "name": "tenant_key_collections_slug_context_idx",
+            "name": "tenant_keys_slug_context_idx",
             "columns": [
               "slug",
               "context"
@@ -628,13 +804,13 @@
             "unique": true
           },
           {
-            "name": "tenant_key_collections_created_at_idx",
+            "name": "tenant_keys_created_at_idx",
             "columns": [
               "created_at"
             ]
           }
         ],
-        "version": "26616d13"
+        "version": "79fd7e46"
       }
     },
     "@happyvertical/smrt-secrets:Secret": {
@@ -885,7 +1061,8 @@
               "slug",
               "context"
             ],
-            "unique": true
+            "unique": true,
+            "nullsNotDistinct": true
           },
           {
             "name": "secrets_tenant_id_created_at_idx",
@@ -1130,7 +1307,8 @@
               "slug",
               "context"
             ],
-            "unique": true
+            "unique": true,
+            "nullsNotDistinct": true
           },
           {
             "name": "secret_audit_logs_tenant_id_created_at_idx",

package/dist/models/index.js

@@ -1,2 +1,2 @@
-import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "../chunks/TenantKey-by07m170.js";
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "../chunks/TenantKey-TATS2F3C.js";
 export { Secret, SecretAuditLog, TenantKey, createAuditEntry };

package/dist/services/SecretService.js

@@ -1,2 +1,2 @@
-import { n as SecretService, t as SecretKeyDriftError } from "../chunks/SecretService-gOQN_9Fc.js";
+import { n as SecretService, t as SecretKeyDriftError } from "../chunks/SecretService-Cw26e9sn.js";
 export { SecretKeyDriftError, SecretService };

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.49.3",
+  "packageVersion": "0.49.4",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "81582ae7af0a8e20e460f3eb765dd332d1d1fe500a005a7923f5225c67e832e0",
-    "packageJson": "3fd61ff08285a36283671cde4acfffd8d76b800fd0cddda34958de2986725363",
+    "manifest": "84c7876610eec3502df83ddeb8145a89f885a7bfd9d49e0ec6365124382bb372",
+    "packageJson": "a20ae4afedf8bb306f7fe2ef7f7605d1d091704a65483496ef7d615ebb150722",
     "agents": "96fe8095cb8a2673fb8752fdc2940b53ce09d83c42715396ba6812ce215e990b"
   },
   "exports": [
@@ -49,7 +49,7 @@
       "name": "SecretAuditLogCollection",
       "qualifiedName": "@happyvertical/smrt-secrets:SecretAuditLogCollection",
       "collection": "secretauditlogs",
-      "tableName": "secret_audit_log_collections",
+      "tableName": "secret_audit_logs",
       "packageName": "@happyvertical/smrt-secrets",
       "extends": "SmrtCollection",
       "fields": [],
@@ -310,7 +310,7 @@
       "name": "SecretCollection",
       "qualifiedName": "@happyvertical/smrt-secrets:SecretCollection",
       "collection": "secrets",
-      "tableName": "secret_collections",
+      "tableName": "secrets",
       "packageName": "@happyvertical/smrt-secrets",
       "extends": "SmrtCollection",
       "fields": [],
@@ -568,7 +568,7 @@
       "name": "TenantKeyCollection",
       "qualifiedName": "@happyvertical/smrt-secrets:TenantKeyCollection",
       "collection": "tenantkeys",
-      "tableName": "tenant_key_collections",
+      "tableName": "tenant_keys",
       "packageName": "@happyvertical/smrt-secrets",
       "extends": "SmrtCollection",
       "fields": [],
@@ -1881,7 +1881,7 @@
     "junctionCollections": 0,
     "hierarchicalObjects": 0,
     "polymorphicAssociations": 0,
-    "uuidColumns": 10
+    "uuidColumns": 14
   },
   "agentDoc": "# @happyvertical/smrt-secrets\n\nEnvelope encryption for per-tenant secret storage with key rotation and audit logging.\n\n## Encryption Architecture\n\n```\nSecret value → encrypted with TDEK (per-tenant Data Encryption Key)\n  TDEK → wrapped with AMK (Application Master Key, from env SMRT_SECRET_MASTER_KEY)\n```\n\n## Models\n\n- **Secret**: `encryptedValue` (JSON envelope), `category`, `status` (active/disabled/expired), `expiresAt`, `accessCount`, `lastAccessedAt`. **No API/MCP exposure** (security). CLI: list-only.\n- **TenantKey**: per-tenant TDEK in wrapped form. Status: active/rotating/retired/compromised. **Not tenant-scoped itself** — it tracks keys FOR tenants.\n- **SecretAuditLog**: action (create/read/update/delete/rotate_key/disable/enable), result (success/failure/denied), user/IP tracking. CLI: list-only.\n\n## SecretService\n\n| Method | Behavior |\n|--------|----------|\n| `store(name, value, options)` | Encrypt + save. Upsert if exists. Uses `context=tenantId` for per-tenant uniqueness. |\n| `retrieve(name)` | Decrypt + audit + increment accessCount |\n| `diagnoseTenantSecretKeyDrift(tenantId)` | Report active secret/key drift without exposing values. Checks `secrets`, SDK `tenant_encryption_keys`, and SMRT `tenant_keys`. |\n| `repairTenantSecretKeyDrift(tenantId, opts)` | Explicit repair path for unrecoverable drift. Use `dryRun` first; destructive cleanup requires `confirmDeleteUnrecoverableData: true`. |\n| `rotateKey()` | Create new TDEK, mark old as retired |\n| `reencryptAll()` | Decrypt with old TDEK, re-encrypt with new — **must call separately after rotateKey()** |\n| `disable(name)` / `enable(name)` | Toggle status |\n\n## Gotchas\n\n- **Key rotation doesn't auto-re-encrypt**: call `reencryptAll()` separately after `rotateKey()`\n- **retrieve() increments accessCount**: every read is tracked\n- **TenantKey NOT tenant-scoped**: it stores keys for tenants but isn't filtered by tenant context\n- **Two key tables**: `tenant_encryption_keys` is the lower-level SDK table used by `SecretService` encryption; `tenant_keys` is the SMRT model table. Drift diagnosis reports both so an empty `tenant_keys` view is not confused with missing SDK key material.\n- **Repair is destructive only by confirmation**: `repairTenantSecretKeyDrift()` deletes unrecoverable encrypted rows only when `confirmDeleteUnrecoverableData: true` is explicit. Do not silently discard encrypted secrets.\n- **Expired secrets filtered by default**: pass `includeExpired: true` to list them\n- **TenantKeyCollection.cleanupRetiredKeys()**: hard-deletes after 90 days\n- **Audit logging optional but default**: failures logged to console, not thrown\n- **Audit rows outlive secrets**: `SecretAuditLog.secretId` uses the explicit\n  same-package app-side-only FK option. It retains relationship metadata and an\n  index, but emits no physical constraint because compliance logs are retained\n  for 1-7 years while secrets may be deleted or purged during key-drift repair.\n\n## Known exceptions to monorepo standards\n\nPer `docs/content/standards.md §7`, tenant-aware models should normally apply\n`@TenantScoped({ mode: 'optional' })` from `@happyvertical/smrt-tenancy`. The three\nmodels in this package deviate intentionally; each `@smrt(...)` block carries an\ninline comment pointing back to this section.\n\n- **`Secret` (`src/models/Secret.ts`)** — uses the inline `tenantScoped: true` form\n  on `@smrt()` instead of the `@TenantScoped` decorator. `SecretService.store()`\n  performs manual scoping by populating `context = tenantId` on each row, so the\n  `(slug, context)` upsert key from the base `SmrtObject` is what isolates secret\n  names per tenant. Switching to the decorator without rethinking the upsert key\n  would surface false-positive name collisions across tenants.\n- **`TenantKey` (`src/models/TenantKey.ts`)** — deliberately NOT tenant-scoped at\n  all. The row carries a `tenantId` column because each TDEK belongs to a tenant,\n  but key-rotation tooling, AMK rewrap jobs, and super-admin audits must query\n  across tenants; the tenancy interceptor would silently filter rows those flows\n  rely on.\n- **`SecretAuditLog` (`src/models/SecretAuditLog.ts`)** — uses the inline\n  `tenantScoped: true` form rather than the decorator. Audit reads run in mixed\n  contexts (tenant-scoped reports vs. super-admin compliance review). Cross-\n  tenant audit queries should be wrapped in `withSuperAdminBypass()` from\n  `@happyvertical/smrt-tenancy` at the call site — there are no such cross-\n  tenant call sites in this package today, but consumers building compliance\n  tooling should adopt that pattern explicitly rather than relying on\n  decorator-implicit filtering. Its `secretId` relationship is also deliberately\n  app-side-only so immutable audit history can survive deletion of the secret.\n"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-secrets",
-  "version": "0.49.3",
+  "version": "0.49.4",
   "description": "Per-tenant secret management with envelope encryption for SMRT",
   "type": "module",
   "main": "./dist/index.js",
@@ -29,13 +29,13 @@
   "dependencies": {
     "@happyvertical/logger": "^0.89.6",
     "@happyvertical/secrets": "^0.89.6",
-    "@happyvertical/smrt-core": "0.49.3",
-    "@happyvertical/smrt-tenancy": "0.49.3",
+    "@happyvertical/smrt-core": "0.49.4",
+    "@happyvertical/smrt-tenancy": "0.49.4",
     "@happyvertical/sql": "^0.89.6",
     "@happyvertical/utils": "^0.89.6"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.49.3",
+    "@happyvertical/smrt-vitest": "0.49.4",
     "@types/node": "24.13.2",
     "typescript": "5.9.3",
     "vite": "8.1.4",