@happyvertical/smrt-secrets 0.51.38 → 0.52.0

package/dist/chunks/TenantKey-DLV_Agrm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantKey-DLV_Agrm.js","names":[],"sources":["../../src/__smrt-register__.ts","../../src/models/SecretAuditLog.ts","../../src/models/Secret.ts","../../src/models/TenantKey.ts"],"sourcesContent":["// Generated by @happyvertical/smrt-core smrtPlugin at library build time.\n// The package manifest is inlined so self-registration cannot miss when a\n// downstream bundler relocates this module away from dist/manifest.json\n// (https://github.com/happyvertical/smrt/issues/1506,\n//  https://github.com/happyvertical/smrt/issues/1507).\nimport { ObjectRegistry } from '@happyvertical/smrt-core';\n\nObjectRegistry.registerPackageManifest(JSON.parse(\"{\\\"version\\\":\\\"1.0.0\\\",\\\"timestamp\\\":0,\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"packageVersion\\\":\\\"0.52.0\\\",\\\"objects\\\":{\\\"@happyvertical/smrt-secrets:SecretAuditLogCollection\\\":{\\\"name\\\":\\\"secretauditlogcollection\\\",\\\"className\\\":\\\"SecretAuditLogCollection\\\",\\\"qualifiedName\\\":\\\"@happyvertical/smrt-secrets:SecretAuditLogCollection\\\",\\\"collection\\\":\\\"secretauditlogs\\\",\\\"filePath\\\":\\\"/home/runner/work/smrt/smrt/packages/secrets/src/collections/SecretAuditLogCollection.ts\\\",\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"fields\\\":{},\\\"methods\\\":{\\\"listLogs\\\":{\\\"name\\\":\\\"listLogs\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"options\\\",\\\"type\\\":\\\"ListAuditLogsOptions\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<SecretAuditLog[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"getSecretHistory\\\":{\\\"name\\\":\\\"getSecretHistory\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string | null\\\",\\\"optional\\\":false,\\\"unionBranches\\\":[{\\\"type\\\":\\\"string\\\"},{\\\"type\\\":\\\"null\\\"}]},{\\\"name\\\":\\\"secretName\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"limit\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<SecretAuditLog[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"getUserActivity\\\":{\\\"name\\\":\\\"getUserActivity\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string | null\\\",\\\"optional\\\":false,\\\"unionBranches\\\":[{\\\"type\\\":\\\"string\\\"},{\\\"type\\\":\\\"null\\\"}]},{\\\"name\\\":\\\"userId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"limit\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<SecretAuditLog[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"getRecentFailures\\\":{\\\"name\\\":\\\"getRecentFailures\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string | null\\\",\\\"optional\\\":false,\\\"unionBranches\\\":[{\\\"type\\\":\\\"string\\\"},{\\\"type\\\":\\\"null\\\"}]},{\\\"name\\\":\\\"limit\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<SecretAuditLog[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"getRecentDenials\\\":{\\\"name\\\":\\\"getRecentDenials\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string | null\\\",\\\"optional\\\":false,\\\"unionBranches\\\":[{\\\"type\\\":\\\"string\\\"},{\\\"type\\\":\\\"null\\\"}]},{\\\"name\\\":\\\"limit\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<SecretAuditLog[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"countByAction\\\":{\\\"name\\\":\\\"countByAction\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string | null\\\",\\\"optional\\\":false,\\\"unionBranches\\\":[{\\\"type\\\":\\\"string\\\"},{\\\"type\\\":\\\"null\\\"}]},{\\\"name\\\":\\\"since\\\",\\\"type\\\":\\\"Date\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<Record<SecretAuditAction, number>>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"countByResult\\\":{\\\"name\\\":\\\"countByResult\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string | null\\\",\\\"optional\\\":false,\\\"unionBranches\\\":[{\\\"type\\\":\\\"string\\\"},{\\\"type\\\":\\\"null\\\"}]},{\\\"name\\\":\\\"since\\\",\\\"type\\\":\\\"Date\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<Record<SecretAuditResult, number>>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"cleanup\\\":{\\\"name\\\":\\\"cleanup\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"olderThanDays\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<number>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true}},\\\"decoratorConfig\\\":{},\\\"extends\\\":\\\"SmrtCollection\\\",\\\"extendsTypeArg\\\":\\\"SecretAuditLog\\\",\\\"exportName\\\":\\\"SecretAuditLogCollection\\\",\\\"collectionExportName\\\":\\\"SecretAuditLogCollectionCollection\\\",\\\"schema\\\":{\\\"tableName\\\":\\\"secret_audit_logs\\\",\\\"ddl\\\":\\\"CREATE TABLE IF NOT EXISTS \\\\\\\"secret_audit_logs\\\\\\\" (\\\\n  \\\\\\\"id\\\\\\\" UUID PRIMARY KEY NOT NULL,\\\\n  \\\\\\\"slug\\\\\\\" TEXT NOT NULL,\\\\n  \\\\\\\"context\\\\\\\" TEXT NOT NULL DEFAULT '',\\\\n  \\\\\\\"created_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"updated_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"tenant_id\\\\\\\" UUID,\\\\n  \\\\\\\"secret_id\\\\\\\" UUID,\\\\n  \\\\\\\"secret_name\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"user_id\\\\\\\" UUID,\\\\n  \\\\\\\"action\\\\\\\" TEXT DEFAULT 'read',\\\\n  \\\\\\\"result\\\\\\\" TEXT DEFAULT 'success',\\\\n  \\\\\\\"ip_address\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"user_agent\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"details\\\\\\\" JSON DEFAULT '{}'\\\\n);\\\",\\\"columns\\\":{\\\"id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"primaryKey\\\":true,\\\"referenceKind\\\":\\\"id\\\",\\\"notNull\\\":true},\\\"slug\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true},\\\"context\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"\\\"},\\\"created_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"updated_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"tenant_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"tenantId\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"secret_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"foreignKey\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"secret_name\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"user_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"crossPackageRef\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"action\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"read\\\"},\\\"result\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"success\\\"},\\\"ip_address\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"user_agent\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"details\\\":{\\\"type\\\":\\\"JSON\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":{}}},\\\"indexes\\\":[{\\\"name\\\":\\\"secret_audit_logs_slug_context_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"],\\\"unique\\\":true,\\\"nullsNotDistinct\\\":true},{\\\"name\\\":\\\"secret_audit_logs_tenant_id_created_at_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"created_at\\\"]},{\\\"name\\\":\\\"secret_audit_logs_secret_id_idx\\\",\\\"columns\\\":[\\\"secret_id\\\"]},{\\\"name\\\":\\\"secret_audit_logs_user_id_idx\\\",\\\"columns\\\":[\\\"user_id\\\"]}],\\\"version\\\":\\\"af0d679d\\\"},\\\"importPath\\\":\\\"@happyvertical/smrt-secrets\\\"},\\\"@happyvertical/smrt-secrets:SecretCollection\\\":{\\\"name\\\":\\\"secretcollection\\\",\\\"className\\\":\\\"SecretCollection\\\",\\\"qualifiedName\\\":\\\"@happyvertical/smrt-secrets:SecretCollection\\\",\\\"collection\\\":\\\"secrets\\\",\\\"filePath\\\":\\\"/home/runner/work/smrt/smrt/packages/secrets/src/collections/SecretCollection.ts\\\",\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"fields\\\":{},\\\"methods\\\":{\\\"findByName\\\":{\\\"name\\\":\\\"findByName\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"name\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<Secret | null>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"listSecrets\\\":{\\\"name\\\":\\\"listSecrets\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"options\\\",\\\"type\\\":\\\"ListSecretsOptions\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<Secret[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"listActive\\\":{\\\"name\\\":\\\"listActive\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<Secret[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"listByCategory\\\":{\\\"name\\\":\\\"listByCategory\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"category\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<Secret[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"listExpiring\\\":{\\\"name\\\":\\\"listExpiring\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"daysAhead\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<Secret[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"getCategories\\\":{\\\"name\\\":\\\"getCategories\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<string[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"countByStatus\\\":{\\\"name\\\":\\\"countByStatus\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<Record<SecretStatus, number>>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"deleteByName\\\":{\\\"name\\\":\\\"deleteByName\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"name\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<boolean>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true}},\\\"decoratorConfig\\\":{},\\\"extends\\\":\\\"SmrtCollection\\\",\\\"extendsTypeArg\\\":\\\"Secret\\\",\\\"exportName\\\":\\\"SecretCollection\\\",\\\"collectionExportName\\\":\\\"SecretCollectionCollection\\\",\\\"schema\\\":{\\\"tableName\\\":\\\"secrets\\\",\\\"ddl\\\":\\\"CREATE TABLE IF NOT EXISTS \\\\\\\"secrets\\\\\\\" (\\\\n  \\\\\\\"id\\\\\\\" UUID PRIMARY KEY NOT NULL,\\\\n  \\\\\\\"slug\\\\\\\" TEXT NOT NULL,\\\\n  \\\\\\\"context\\\\\\\" TEXT NOT NULL DEFAULT '',\\\\n  \\\\\\\"created_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"updated_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"tenant_id\\\\\\\" UUID,\\\\n  \\\\\\\"name\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"description\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"category\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"encrypted_value\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"key_version\\\\\\\" INTEGER DEFAULT 1,\\\\n  \\\\\\\"status\\\\\\\" TEXT DEFAULT 'active',\\\\n  \\\\\\\"expires_at\\\\\\\" TIMESTAMP,\\\\n  \\\\\\\"last_accessed_at\\\\\\\" TIMESTAMP,\\\\n  \\\\\\\"access_count\\\\\\\" INTEGER DEFAULT 0,\\\\n  \\\\\\\"metadata\\\\\\\" JSON DEFAULT '{}'\\\\n);\\\",\\\"columns\\\":{\\\"id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"primaryKey\\\":true,\\\"referenceKind\\\":\\\"id\\\",\\\"notNull\\\":true},\\\"slug\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true},\\\"context\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"\\\"},\\\"created_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"updated_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"tenant_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"tenantId\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"name\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"description\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"category\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"encrypted_value\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"key_version\\\":{\\\"type\\\":\\\"INTEGER\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":1},\\\"status\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"active\\\"},\\\"expires_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"last_accessed_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"access_count\\\":{\\\"type\\\":\\\"INTEGER\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":0},\\\"metadata\\\":{\\\"type\\\":\\\"JSON\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":{}}},\\\"indexes\\\":[{\\\"name\\\":\\\"secrets_slug_context_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"],\\\"unique\\\":true,\\\"nullsNotDistinct\\\":true},{\\\"name\\\":\\\"secrets_tenant_id_created_at_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"created_at\\\"]}],\\\"version\\\":\\\"6298a980\\\"},\\\"importPath\\\":\\\"@happyvertical/smrt-secrets\\\"},\\\"@happyvertical/smrt-secrets:TenantKeyCollection\\\":{\\\"name\\\":\\\"tenantkeycollection\\\",\\\"className\\\":\\\"TenantKeyCollection\\\",\\\"qualifiedName\\\":\\\"@happyvertical/smrt-secrets:TenantKeyCollection\\\",\\\"collection\\\":\\\"tenantkeys\\\",\\\"filePath\\\":\\\"/home/runner/work/smrt/smrt/packages/secrets/src/collections/TenantKeyCollection.ts\\\",\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"fields\\\":{},\\\"methods\\\":{\\\"getActiveKey\\\":{\\\"name\\\":\\\"getActiveKey\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<TenantKey | null>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"listKeyVersions\\\":{\\\"name\\\":\\\"listKeyVersions\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<TenantKey[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"getKeyVersion\\\":{\\\"name\\\":\\\"getKeyVersion\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"version\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<TenantKey | null>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"findKeysNeedingRotation\\\":{\\\"name\\\":\\\"findKeysNeedingRotation\\\",\\\"async\\\":true,\\\"parameters\\\":[],\\\"returnType\\\":\\\"Promise<TenantKey[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"listAllActiveKeys\\\":{\\\"name\\\":\\\"listAllActiveKeys\\\",\\\"async\\\":true,\\\"parameters\\\":[],\\\"returnType\\\":\\\"Promise<TenantKey[]>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"countByStatus\\\":{\\\"name\\\":\\\"countByStatus\\\",\\\"async\\\":true,\\\"parameters\\\":[],\\\"returnType\\\":\\\"Promise<Record<TenantKeyStatus, number>>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"markCompromised\\\":{\\\"name\\\":\\\"markCompromised\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"tenantId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false},{\\\"name\\\":\\\"keyId\\\",\\\"type\\\":\\\"string\\\",\\\"optional\\\":false}],\\\"returnType\\\":\\\"Promise<boolean>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"cleanupRetiredKeys\\\":{\\\"name\\\":\\\"cleanupRetiredKeys\\\",\\\"async\\\":true,\\\"parameters\\\":[{\\\"name\\\":\\\"olderThanDays\\\",\\\"type\\\":\\\"number\\\",\\\"optional\\\":true}],\\\"returnType\\\":\\\"Promise<number>\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true}},\\\"decoratorConfig\\\":{},\\\"extends\\\":\\\"SmrtCollection\\\",\\\"extendsTypeArg\\\":\\\"TenantKey\\\",\\\"exportName\\\":\\\"TenantKeyCollection\\\",\\\"collectionExportName\\\":\\\"TenantKeyCollectionCollection\\\",\\\"schema\\\":{\\\"tableName\\\":\\\"tenant_keys\\\",\\\"ddl\\\":\\\"CREATE TABLE IF NOT EXISTS \\\\\\\"tenant_keys\\\\\\\" (\\\\n  \\\\\\\"id\\\\\\\" UUID PRIMARY KEY NOT NULL,\\\\n  \\\\\\\"slug\\\\\\\" TEXT NOT NULL,\\\\n  \\\\\\\"context\\\\\\\" TEXT NOT NULL DEFAULT '',\\\\n  \\\\\\\"created_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"updated_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"tenant_id\\\\\\\" UUID,\\\\n  \\\\\\\"wrapped_key\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"amk_key_id\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"status\\\\\\\" TEXT DEFAULT 'active',\\\\n  \\\\\\\"version\\\\\\\" INTEGER DEFAULT 1,\\\\n  \\\\\\\"rotate_after\\\\\\\" TIMESTAMP,\\\\n  \\\\\\\"retired_at\\\\\\\" TIMESTAMP\\\\n);\\\",\\\"columns\\\":{\\\"id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"primaryKey\\\":true,\\\"referenceKind\\\":\\\"id\\\",\\\"notNull\\\":true},\\\"slug\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true},\\\"context\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"\\\"},\\\"created_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"updated_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"tenant_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"wrapped_key\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"amk_key_id\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"status\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"active\\\"},\\\"version\\\":{\\\"type\\\":\\\"INTEGER\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":1},\\\"rotate_after\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"retired_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false}},\\\"indexes\\\":[{\\\"name\\\":\\\"tenant_keys_tenant_id_slug_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"],\\\"unique\\\":true,\\\"nullsNotDistinct\\\":true},{\\\"name\\\":\\\"tenant_keys_created_at_idx\\\",\\\"columns\\\":[\\\"created_at\\\"]}],\\\"version\\\":\\\"abc3474a\\\"},\\\"importPath\\\":\\\"@happyvertical/smrt-secrets\\\"},\\\"@happyvertical/smrt-secrets:Secret\\\":{\\\"name\\\":\\\"secret\\\",\\\"className\\\":\\\"Secret\\\",\\\"qualifiedName\\\":\\\"@happyvertical/smrt-secrets:Secret\\\",\\\"collection\\\":\\\"secrets\\\",\\\"filePath\\\":\\\"/home/runner/work/smrt/smrt/packages/secrets/src/models/Secret.ts\\\",\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"fields\\\":{\\\"tenantId\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\",\\\"_meta\\\":{\\\"sqlType\\\":\\\"UUID\\\",\\\"__tenancy\\\":{\\\"isTenantIdField\\\":true,\\\"mode\\\":\\\"required\\\",\\\"field\\\":\\\"tenantId\\\",\\\"autoFilter\\\":true,\\\"autoPopulate\\\":true,\\\"allowSuperAdminBypass\\\":false}}},\\\"name\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"description\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"category\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"encryptedValue\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"keyVersion\\\":{\\\"type\\\":\\\"integer\\\",\\\"required\\\":false,\\\"default\\\":1},\\\"status\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"active\\\"},\\\"expiresAt\\\":{\\\"type\\\":\\\"datetime\\\",\\\"required\\\":false},\\\"lastAccessedAt\\\":{\\\"type\\\":\\\"datetime\\\",\\\"required\\\":false},\\\"accessCount\\\":{\\\"type\\\":\\\"integer\\\",\\\"required\\\":false,\\\"default\\\":0},\\\"metadata\\\":{\\\"type\\\":\\\"json\\\",\\\"required\\\":false,\\\"default\\\":{}}},\\\"methods\\\":{\\\"isActive\\\":{\\\"name\\\":\\\"isActive\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isExpired\\\":{\\\"name\\\":\\\"isExpired\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isUsable\\\":{\\\"name\\\":\\\"isUsable\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"recordAccess\\\":{\\\"name\\\":\\\"recordAccess\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"void\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"disable\\\":{\\\"name\\\":\\\"disable\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"void\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"enable\\\":{\\\"name\\\":\\\"enable\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"void\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true}},\\\"decoratorConfig\\\":{\\\"sensitive\\\":true,\\\"tenantScoped\\\":true,\\\"api\\\":{\\\"include\\\":[]},\\\"mcp\\\":{\\\"include\\\":[]},\\\"cli\\\":{\\\"include\\\":[\\\"list\\\"],\\\"skipApiCheck\\\":true},\\\"conflictColumns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"]},\\\"extends\\\":\\\"SmrtObject\\\",\\\"exportName\\\":\\\"Secret\\\",\\\"collectionExportName\\\":\\\"SecretCollection\\\",\\\"schema\\\":{\\\"tableName\\\":\\\"secrets\\\",\\\"ddl\\\":\\\"CREATE TABLE IF NOT EXISTS \\\\\\\"secrets\\\\\\\" (\\\\n  \\\\\\\"id\\\\\\\" UUID PRIMARY KEY NOT NULL,\\\\n  \\\\\\\"slug\\\\\\\" TEXT NOT NULL,\\\\n  \\\\\\\"context\\\\\\\" TEXT NOT NULL DEFAULT '',\\\\n  \\\\\\\"created_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"updated_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"tenant_id\\\\\\\" UUID,\\\\n  \\\\\\\"name\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"description\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"category\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"encrypted_value\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"key_version\\\\\\\" INTEGER DEFAULT 1,\\\\n  \\\\\\\"status\\\\\\\" TEXT DEFAULT 'active',\\\\n  \\\\\\\"expires_at\\\\\\\" TIMESTAMP,\\\\n  \\\\\\\"last_accessed_at\\\\\\\" TIMESTAMP,\\\\n  \\\\\\\"access_count\\\\\\\" INTEGER DEFAULT 0,\\\\n  \\\\\\\"metadata\\\\\\\" JSON DEFAULT '{}'\\\\n);\\\",\\\"columns\\\":{\\\"id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"primaryKey\\\":true,\\\"referenceKind\\\":\\\"id\\\",\\\"notNull\\\":true},\\\"slug\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true},\\\"context\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"\\\"},\\\"created_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"updated_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"tenant_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"tenantId\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"name\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"description\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"category\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"encrypted_value\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"key_version\\\":{\\\"type\\\":\\\"INTEGER\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":1},\\\"status\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"active\\\"},\\\"expires_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"last_accessed_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"access_count\\\":{\\\"type\\\":\\\"INTEGER\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":0},\\\"metadata\\\":{\\\"type\\\":\\\"JSON\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":{}}},\\\"indexes\\\":[{\\\"name\\\":\\\"secrets_slug_context_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"],\\\"unique\\\":true,\\\"nullsNotDistinct\\\":true},{\\\"name\\\":\\\"secrets_tenant_id_created_at_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"created_at\\\"]}],\\\"version\\\":\\\"6298a980\\\"},\\\"importPath\\\":\\\"@happyvertical/smrt-secrets/models\\\"},\\\"@happyvertical/smrt-secrets:SecretAuditLog\\\":{\\\"name\\\":\\\"secretauditlog\\\",\\\"className\\\":\\\"SecretAuditLog\\\",\\\"qualifiedName\\\":\\\"@happyvertical/smrt-secrets:SecretAuditLog\\\",\\\"collection\\\":\\\"secretauditlogs\\\",\\\"filePath\\\":\\\"/home/runner/work/smrt/smrt/packages/secrets/src/models/SecretAuditLog.ts\\\",\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"fields\\\":{\\\"tenantId\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"_meta\\\":{\\\"sqlType\\\":\\\"UUID\\\",\\\"__tenancy\\\":{\\\"isTenantIdField\\\":true,\\\"mode\\\":\\\"required\\\",\\\"field\\\":\\\"tenantId\\\",\\\"autoFilter\\\":true,\\\"autoPopulate\\\":true,\\\"allowSuperAdminBypass\\\":false}}},\\\"secretId\\\":{\\\"type\\\":\\\"foreignKey\\\",\\\"required\\\":false,\\\"related\\\":\\\"Secret\\\",\\\"_meta\\\":{\\\"constraint\\\":false}},\\\"secretName\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"userId\\\":{\\\"type\\\":\\\"crossPackageRef\\\",\\\"required\\\":false,\\\"related\\\":\\\"@happyvertical/smrt-users:User\\\"},\\\"action\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"read\\\"},\\\"result\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"success\\\"},\\\"ipAddress\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"userAgent\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"details\\\":{\\\"type\\\":\\\"json\\\",\\\"required\\\":false,\\\"default\\\":{}}},\\\"methods\\\":{\\\"isSuccess\\\":{\\\"name\\\":\\\"isSuccess\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isFailure\\\":{\\\"name\\\":\\\"isFailure\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isDenied\\\":{\\\"name\\\":\\\"isDenied\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isReadAction\\\":{\\\"name\\\":\\\"isReadAction\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isWriteAction\\\":{\\\"name\\\":\\\"isWriteAction\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isKeyOperation\\\":{\\\"name\\\":\\\"isKeyOperation\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true}},\\\"decoratorConfig\\\":{\\\"tenantScoped\\\":true,\\\"api\\\":{\\\"include\\\":[]},\\\"mcp\\\":{\\\"include\\\":[]},\\\"cli\\\":{\\\"include\\\":[\\\"list\\\"],\\\"skipApiCheck\\\":true},\\\"conflictColumns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"]},\\\"extends\\\":\\\"SmrtObject\\\",\\\"exportName\\\":\\\"SecretAuditLog\\\",\\\"collectionExportName\\\":\\\"SecretAuditLogCollection\\\",\\\"schema\\\":{\\\"tableName\\\":\\\"secret_audit_logs\\\",\\\"ddl\\\":\\\"CREATE TABLE IF NOT EXISTS \\\\\\\"secret_audit_logs\\\\\\\" (\\\\n  \\\\\\\"id\\\\\\\" UUID PRIMARY KEY NOT NULL,\\\\n  \\\\\\\"slug\\\\\\\" TEXT NOT NULL,\\\\n  \\\\\\\"context\\\\\\\" TEXT NOT NULL DEFAULT '',\\\\n  \\\\\\\"created_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"updated_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"tenant_id\\\\\\\" UUID,\\\\n  \\\\\\\"secret_id\\\\\\\" UUID,\\\\n  \\\\\\\"secret_name\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"user_id\\\\\\\" UUID,\\\\n  \\\\\\\"action\\\\\\\" TEXT DEFAULT 'read',\\\\n  \\\\\\\"result\\\\\\\" TEXT DEFAULT 'success',\\\\n  \\\\\\\"ip_address\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"user_agent\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"details\\\\\\\" JSON DEFAULT '{}'\\\\n);\\\",\\\"columns\\\":{\\\"id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"primaryKey\\\":true,\\\"referenceKind\\\":\\\"id\\\",\\\"notNull\\\":true},\\\"slug\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true},\\\"context\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"\\\"},\\\"created_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"updated_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"tenant_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"tenantId\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"secret_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"foreignKey\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"secret_name\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"user_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"referenceKind\\\":\\\"crossPackageRef\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"action\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"read\\\"},\\\"result\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"success\\\"},\\\"ip_address\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"user_agent\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"details\\\":{\\\"type\\\":\\\"JSON\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":{}}},\\\"indexes\\\":[{\\\"name\\\":\\\"secret_audit_logs_slug_context_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"],\\\"unique\\\":true,\\\"nullsNotDistinct\\\":true},{\\\"name\\\":\\\"secret_audit_logs_tenant_id_created_at_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"created_at\\\"]},{\\\"name\\\":\\\"secret_audit_logs_secret_id_idx\\\",\\\"columns\\\":[\\\"secret_id\\\"]},{\\\"name\\\":\\\"secret_audit_logs_user_id_idx\\\",\\\"columns\\\":[\\\"user_id\\\"]}],\\\"version\\\":\\\"af0d679d\\\"},\\\"importPath\\\":\\\"@happyvertical/smrt-secrets/models\\\"},\\\"@happyvertical/smrt-secrets:TenantKey\\\":{\\\"name\\\":\\\"tenantkey\\\",\\\"className\\\":\\\"TenantKey\\\",\\\"qualifiedName\\\":\\\"@happyvertical/smrt-secrets:TenantKey\\\",\\\"collection\\\":\\\"tenantkeys\\\",\\\"filePath\\\":\\\"/home/runner/work/smrt/smrt/packages/secrets/src/models/TenantKey.ts\\\",\\\"packageName\\\":\\\"@happyvertical/smrt-secrets\\\",\\\"fields\\\":{\\\"tenantId\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\",\\\"_meta\\\":{\\\"sqlType\\\":\\\"UUID\\\"}},\\\"wrappedKey\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"amkKeyId\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"\\\"},\\\"status\\\":{\\\"type\\\":\\\"text\\\",\\\"required\\\":false,\\\"default\\\":\\\"active\\\"},\\\"version\\\":{\\\"type\\\":\\\"integer\\\",\\\"required\\\":false,\\\"default\\\":1},\\\"rotateAfter\\\":{\\\"type\\\":\\\"datetime\\\",\\\"required\\\":false},\\\"retiredAt\\\":{\\\"type\\\":\\\"datetime\\\",\\\"required\\\":false}},\\\"methods\\\":{\\\"isActive\\\":{\\\"name\\\":\\\"isActive\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"needsRotation\\\":{\\\"name\\\":\\\"needsRotation\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isRetired\\\":{\\\"name\\\":\\\"isRetired\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"isCompromised\\\":{\\\"name\\\":\\\"isCompromised\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"canDecrypt\\\":{\\\"name\\\":\\\"canDecrypt\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"canEncrypt\\\":{\\\"name\\\":\\\"canEncrypt\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"boolean\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"retire\\\":{\\\"name\\\":\\\"retire\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"void\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true},\\\"markCompromised\\\":{\\\"name\\\":\\\"markCompromised\\\",\\\"async\\\":false,\\\"parameters\\\":[],\\\"returnType\\\":\\\"void\\\",\\\"isStatic\\\":false,\\\"isPublic\\\":true}},\\\"decoratorConfig\\\":{\\\"sensitive\\\":true,\\\"api\\\":{\\\"include\\\":[]},\\\"mcp\\\":{\\\"include\\\":[]},\\\"cli\\\":{\\\"include\\\":[\\\"list\\\",\\\"get\\\"],\\\"skipApiCheck\\\":true},\\\"conflictColumns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"]},\\\"extends\\\":\\\"SmrtObject\\\",\\\"exportName\\\":\\\"TenantKey\\\",\\\"collectionExportName\\\":\\\"TenantKeyCollection\\\",\\\"schema\\\":{\\\"tableName\\\":\\\"tenant_keys\\\",\\\"ddl\\\":\\\"CREATE TABLE IF NOT EXISTS \\\\\\\"tenant_keys\\\\\\\" (\\\\n  \\\\\\\"id\\\\\\\" UUID PRIMARY KEY NOT NULL,\\\\n  \\\\\\\"slug\\\\\\\" TEXT NOT NULL,\\\\n  \\\\\\\"context\\\\\\\" TEXT NOT NULL DEFAULT '',\\\\n  \\\\\\\"created_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"updated_at\\\\\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\\\n  \\\\\\\"tenant_id\\\\\\\" UUID,\\\\n  \\\\\\\"wrapped_key\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"amk_key_id\\\\\\\" TEXT DEFAULT '',\\\\n  \\\\\\\"status\\\\\\\" TEXT DEFAULT 'active',\\\\n  \\\\\\\"version\\\\\\\" INTEGER DEFAULT 1,\\\\n  \\\\\\\"rotate_after\\\\\\\" TIMESTAMP,\\\\n  \\\\\\\"retired_at\\\\\\\" TIMESTAMP\\\\n);\\\",\\\"columns\\\":{\\\"id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"primaryKey\\\":true,\\\"referenceKind\\\":\\\"id\\\",\\\"notNull\\\":true},\\\"slug\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true},\\\"context\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"\\\"},\\\"created_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"updated_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":true,\\\"default\\\":\\\"current_timestamp\\\"},\\\"tenant_id\\\":{\\\"type\\\":\\\"UUID\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"wrapped_key\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"amk_key_id\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"\\\"},\\\"status\\\":{\\\"type\\\":\\\"TEXT\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":\\\"active\\\"},\\\"version\\\":{\\\"type\\\":\\\"INTEGER\\\",\\\"notNull\\\":false,\\\"unique\\\":false,\\\"default\\\":1},\\\"rotate_after\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false},\\\"retired_at\\\":{\\\"type\\\":\\\"TIMESTAMP\\\",\\\"notNull\\\":false,\\\"unique\\\":false}},\\\"indexes\\\":[{\\\"name\\\":\\\"tenant_keys_tenant_id_slug_idx\\\",\\\"columns\\\":[\\\"tenant_id\\\",\\\"slug\\\",\\\"context\\\"],\\\"unique\\\":true,\\\"nullsNotDistinct\\\":true},{\\\"name\\\":\\\"tenant_keys_created_at_idx\\\",\\\"columns\\\":[\\\"created_at\\\"]}],\\\"version\\\":\\\"abc3474a\\\"},\\\"importPath\\\":\\\"@happyvertical/smrt-secrets/models\\\"}},\\\"moduleType\\\":\\\"smrt\\\",\\\"smrtDependencies\\\":[\\\"@happyvertical/smrt-core\\\",\\\"@happyvertical/smrt-tenancy\\\"]}\"));\n","/**\n * SecretAuditLog model - Audit trail for secret operations\n * @packageDocumentation\n */\n\nimport type {\n  SmrtCreateInput,\n  SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\n\n/**\n * Secret audit action types\n */\nexport type SecretAuditAction =\n  | 'create'\n  | 'read'\n  | 'update'\n  | 'delete'\n  | 'rotate_key'\n  | 'disable'\n  | 'enable'\n  | 'expire';\n\n/**\n * Audit result types\n */\nexport type SecretAuditResult = 'success' | 'failure' | 'denied';\n\n/**\n * Constructor options for {@link SecretAuditLog}. Each field is optional and\n * mirrors a persisted column.\n */\nexport interface SecretAuditLogOptions extends SmrtObjectOptions {\n  tenantId?: string | null;\n  secretId?: string | null;\n  secretName?: string;\n  userId?: string | null;\n  action?: SecretAuditAction;\n  result?: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}\n\n/**\n * SecretAuditLog records all operations on secrets for compliance\n * and security monitoring.\n *\n * Every secret operation (create, read, update, delete, key rotation)\n * is logged with the user, action, result, and relevant details.\n *\n * **Retention**: Audit logs should be retained according to your\n * compliance requirements (typically 1-7 years).\n *\n * @example\n * ```typescript\n * // Query recent audit logs\n * const logs = await auditLogs.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'created_at DESC',\n *   limit: 100\n * });\n *\n * // Filter by action\n * const reads = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     action: 'read'\n *   }\n * });\n *\n * // Filter by secret name\n * const apiKeyLogs = await auditLogs.list({\n *   where: {\n *     tenantId: 'tenant-123',\n *     secretName: 'stripe-api-key'\n *   }\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `SecretAuditLog` uses the inline `tenantScoped: true` form on `@smrt()` rather than\n// the dedicated `@TenantScoped` decorator. Audit-trail queries are read-mostly and run\n// in mixed contexts — under a tenant for tenant-scoped reports, and (prospectively)\n// under super-admin bypass for compliance review. Cross-tenant audit queries should\n// be wrapped in `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy` at the\n// call site; this package has no such call sites today, so the pattern is\n// prescriptive guidance for compliance tooling rather than current practice. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  tenantScoped: true,\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for compliance review; HTTP exposure is intentionally\n  // excluded, so skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true },\n})\nexport class SecretAuditLog extends SmrtObject {\n  /**\n   * Tenant associated with the audited secret operation.\n   */\n  tenantId: string | null = null;\n\n  /**\n   * ID of the secret (may identify a secret that has since been deleted).\n   *\n   * Compliance audit rows intentionally outlive their source secret, so this\n   * remains an app-side relationship without a physical database constraint.\n   */\n  @foreignKey('Secret', { constraint: false })\n  secretId: string | null = null;\n\n  /**\n   * Name of the secret at the time of the operation\n   */\n  secretName: string = '';\n\n  /**\n   * ID of the user who performed the action, or `null` for system-initiated\n   * operations with no authenticated user. Stored as a native `uuid` column on\n   * Postgres, so a non-UUID actor sentinel must never reach it —\n   * {@link createAuditEntry} normalizes the `'system'` sentinel to null (#1444).\n   */\n  @crossPackageRef('@happyvertical/smrt-users:User')\n  userId: string | null = null;\n\n  /**\n   * The action that was performed\n   */\n  action: SecretAuditAction = 'read';\n\n  /**\n   * Result of the operation\n   */\n  result: SecretAuditResult = 'success';\n\n  /**\n   * IP address of the client (if available)\n   */\n  ipAddress: string = '';\n\n  /**\n   * User agent string (if available)\n   */\n  userAgent: string = '';\n\n  /**\n   * Additional context about the operation\n   */\n  details: Record<string, unknown> = {};\n\n  constructor(options: SecretAuditLogOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) {\n      this.tenantId = options.tenantId;\n    }\n    if (options.secretId !== undefined) this.secretId = options.secretId;\n    if (options.secretName !== undefined) this.secretName = options.secretName;\n    if (options.userId !== undefined) this.userId = options.userId;\n    if (options.action !== undefined) this.action = options.action;\n    if (options.result !== undefined) this.result = options.result;\n    if (options.ipAddress !== undefined) this.ipAddress = options.ipAddress;\n    if (options.userAgent !== undefined) this.userAgent = options.userAgent;\n    if (options.details !== undefined) this.details = options.details;\n  }\n\n  /**\n   * Check if this was a successful operation\n   */\n  isSuccess(): boolean {\n    return this.result === 'success';\n  }\n\n  /**\n   * Check if this was a failed operation\n   */\n  isFailure(): boolean {\n    return this.result === 'failure';\n  }\n\n  /**\n   * Check if this was a denied operation (permission denied)\n   */\n  isDenied(): boolean {\n    return this.result === 'denied';\n  }\n\n  /**\n   * Check if this is a read operation\n   */\n  isReadAction(): boolean {\n    return this.action === 'read';\n  }\n\n  /**\n   * Check if this is a write operation (create, update, delete)\n   */\n  isWriteAction(): boolean {\n    return ['create', 'update', 'delete'].includes(this.action);\n  }\n\n  /**\n   * Check if this is a key operation\n   */\n  isKeyOperation(): boolean {\n    return this.action === 'rotate_key';\n  }\n}\n\nconst UUID_PATTERN =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/**\n * Create an audit log entry for a secret operation\n */\nexport function createAuditEntry(params: {\n  secretId?: string | null;\n  secretName: string;\n  tenantId?: string | null;\n  userId?: string | null;\n  action: SecretAuditAction;\n  result: SecretAuditResult;\n  ipAddress?: string;\n  userAgent?: string;\n  details?: Record<string, unknown>;\n}): SmrtCreateInput<SecretAuditLog> {\n  const tenantId =\n    params.tenantId === undefined || params.tenantId === 'system'\n      ? null\n      : params.tenantId;\n\n  // The `userId` column is a native `uuid` on Postgres. A missing actor and the\n  // `'system'`/empty sentinels are not valid UUIDs, so normalize them all to\n  // null — a system-initiated operation has no authenticated user. Callers may\n  // pass `null`/`undefined` directly to express that (#1444).\n  // Any other value that is not a uuid (an email-login identity, a service\n  // name) would fail the insert and with it the audited operation; record it\n  // in `details.actorId` instead so the actor is never lost.\n  const rawUserId =\n    params.userId == null || params.userId === 'system' || params.userId === ''\n      ? null\n      : params.userId;\n  const userId =\n    rawUserId !== null && UUID_PATTERN.test(rawUserId) ? rawUserId : null;\n  const details =\n    rawUserId !== null && userId === null\n      ? { ...(params.details ?? {}), actorId: rawUserId }\n      : (params.details ?? {});\n\n  const entry: SmrtCreateInput<SecretAuditLog> = {\n    secretId: params.secretId ?? null,\n    secretName: params.secretName,\n    userId,\n    action: params.action,\n    result: params.result,\n    ipAddress: params.ipAddress ?? '',\n    userAgent: params.userAgent ?? '',\n    details,\n    tenantId,\n  };\n  return entry;\n}\n","/**\n * Secret model - Tenant-scoped encrypted secrets storage\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Secret status values\n */\nexport type SecretStatus = 'active' | 'disabled' | 'expired';\n\n/**\n * Constructor options for {@link Secret}. Each field is optional and mirrors a\n * persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface SecretOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  name?: string;\n  description?: string;\n  category?: string;\n  encryptedValue?: string;\n  keyVersion?: number;\n  status?: SecretStatus;\n  expiresAt?: Date | string | number | null;\n  lastAccessedAt?: Date | string | number | null;\n  accessCount?: number;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Secret represents an encrypted value stored per-tenant.\n *\n * Secrets are tenant-scoped and use envelope encryption:\n * - Each tenant has their own Data Encryption Key (TDEK)\n * - The TDEK is wrapped by the Application Master Key (AMK)\n * - Secret values are encrypted by the unwrapped TDEK\n *\n * **Security**: This model deliberately excludes API and MCP exposure\n * to prevent accidental secret leakage. Secrets are only accessible\n * via CLI commands or direct service calls.\n *\n * @example\n * ```typescript\n * import { SecretService } from '@happyvertical/smrt-secrets';\n *\n * const service = await SecretService.create({ db });\n *\n * await withTenant({ tenantId: 'tenant-123' }, async () => {\n *   // Store a secret\n *   await service.store('api-key', 'sk_live_xxx', { category: 'stripe' });\n *\n *   // Retrieve (auto-decrypts)\n *   const apiKey = await service.retrieve('api-key');\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `Secret` uses the inline `tenantScoped: true` form on `@smrt()` rather than the\n// dedicated `@TenantScoped` decorator from `@happyvertical/smrt-tenancy`. The boolean\n// form gives us required-mode tenant scoping without depending on the tenancy package\n// at the model layer, while `SecretService` performs manual scoping by setting\n// `context = tenantId` on each row. The `(slug, context)` upsert key derived from the\n// base `SmrtObject` fields is what gives different tenants isolated namespaces for\n// secret names — switching to the decorator without changing the upsert key would\n// surface false-positive name collisions across tenants. See\n// `packages/secrets/CLAUDE.md` \"Known exceptions to monorepo standards\" for context.\n@smrt({\n  // Stores key material; never in the change feed (#2937).\n  sensitive: true,\n  tenantScoped: true,\n  // NO API or MCP exposure for security\n  api: { include: [] },\n  mcp: { include: [] },\n  // CLI runs in-process; secrets must never be reachable over HTTP, so\n  // skipApiCheck acknowledges the cli.include / api.include divergence.\n  cli: { include: ['list'], skipApiCheck: true }, // Only list names, not values\n})\nexport class Secret extends SmrtObject {\n  /**\n   * Tenant that owns this secret. Also stored in context for per-tenant name uniqueness.\n   */\n  tenantId: string = '';\n\n  /**\n   * Unique name for the secret within the tenant\n   */\n  name: string = '';\n\n  /**\n   * Human-readable description\n   */\n  description: string = '';\n\n  /**\n   * Category for organization (e.g., 'database', 'api-key', 'oauth')\n   */\n  category: string = '';\n\n  /**\n   * JSON-encoded EncryptedEnvelope from @happyvertical/secrets\n   */\n  encryptedValue: string = '';\n\n  /**\n   * Version of the tenant key used to encrypt this secret\n   */\n  keyVersion: number = 1;\n\n  /**\n   * Current status of the secret\n   */\n  status: SecretStatus = 'active';\n\n  /**\n   * Optional expiration date\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * Last time this secret was accessed (decrypted)\n   */\n  lastAccessedAt: Date | null = null;\n\n  /**\n   * Number of times this secret has been accessed\n   */\n  accessCount: number = 0;\n\n  /**\n   * Additional metadata stored with the secret\n   */\n  metadata: Record<string, unknown> = {};\n\n  constructor(options: SecretOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.name !== undefined) this.name = options.name;\n    if (options.description !== undefined)\n      this.description = options.description;\n    if (options.category !== undefined) this.category = options.category;\n    if (options.encryptedValue !== undefined)\n      this.encryptedValue = options.encryptedValue;\n    if (options.keyVersion !== undefined) this.keyVersion = options.keyVersion;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.expiresAt !== undefined) {\n      this.expiresAt =\n        options.expiresAt instanceof Date\n          ? options.expiresAt\n          : options.expiresAt\n            ? new Date(options.expiresAt)\n            : null;\n    }\n    if (options.lastAccessedAt !== undefined) {\n      this.lastAccessedAt =\n        options.lastAccessedAt instanceof Date\n          ? options.lastAccessedAt\n          : options.lastAccessedAt\n            ? new Date(options.lastAccessedAt)\n            : null;\n    }\n    if (options.accessCount !== undefined)\n      this.accessCount = options.accessCount;\n    if (options.metadata !== undefined) this.metadata = options.metadata;\n  }\n\n  /**\n   * Check if the secret is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if the secret has expired\n   */\n  isExpired(): boolean {\n    if (!this.expiresAt) return false;\n    return new Date() >= this.expiresAt;\n  }\n\n  /**\n   * Check if the secret can be used (active and not expired)\n   */\n  isUsable(): boolean {\n    return this.isActive() && !this.isExpired();\n  }\n\n  /**\n   * Record an access to this secret\n   */\n  recordAccess(): void {\n    this.lastAccessedAt = new Date();\n    this.accessCount += 1;\n  }\n\n  /**\n   * Disable the secret\n   */\n  disable(): void {\n    this.status = 'disabled';\n  }\n\n  /**\n   * Enable the secret\n   */\n  enable(): void {\n    this.status = 'active';\n  }\n}\n","/**\n * TenantKey model - Tracks per-tenant Data Encryption Keys (TDEKs)\n * @packageDocumentation\n */\n\nimport type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport { field, SmrtObject, smrt } from '@happyvertical/smrt-core';\n\n/**\n * Key status values\n */\nexport type TenantKeyStatus = 'active' | 'rotating' | 'retired' | 'compromised';\n\n/**\n * Constructor options for {@link TenantKey}. Each field is optional and mirrors\n * a persisted column; date fields also accept the serialized forms accepted by\n * `new Date()` so hydrated rows coerce cleanly.\n */\nexport interface TenantKeyOptions extends SmrtObjectOptions {\n  tenantId?: string;\n  wrappedKey?: string;\n  amkKeyId?: string;\n  status?: TenantKeyStatus;\n  version?: number;\n  rotateAfter?: Date | string | number | null;\n  retiredAt?: Date | string | number | null;\n}\n\n/**\n * TenantKey tracks the per-tenant Data Encryption Keys (TDEKs).\n *\n * Each tenant has one or more TDEKs stored in wrapped form. The wrapped key\n * can only be decrypted using the Application Master Key (AMK).\n *\n * **Key Lifecycle**:\n * 1. `active` - Current key used for encryption\n * 2. `rotating` - Transitional state during rotation\n * 3. `retired` - Old key kept for decryption of existing secrets\n * 4. `compromised` - Key marked as compromised, should not be used\n *\n * **Note**: This model is NOT tenant-scoped itself because it tracks\n * keys FOR tenants, not secrets owned BY tenants.\n *\n * @example\n * ```typescript\n * // Get active key for a tenant\n * const key = await tenantKeys.get({\n *   tenantId: 'tenant-123',\n *   status: 'active'\n * });\n *\n * // List all key versions for a tenant\n * const versions = await tenantKeys.list({\n *   where: { tenantId: 'tenant-123' },\n *   orderBy: 'version DESC'\n * });\n * ```\n */\n// Intentional exception to standards.md §7 (`@TenantScoped({ mode: 'optional' })`):\n// `TenantKey` is deliberately NOT tenant-scoped — neither via the decorator nor via\n// `tenantScoped: true` on `@smrt()`. The row carries a `tenantId` column because each\n// TDEK belongs to a tenant, but the model itself must remain queryable across tenants\n// (e.g. cross-tenant key-rotation tooling, AMK rewrap jobs, super-admin auditing).\n// Adding the tenancy interceptor here would silently filter out keys the rotation\n// service needs to inspect. See `packages/secrets/CLAUDE.md` \"Known exceptions to\n// monorepo standards\" for the full rationale.\n@smrt({\n  // Stores key material; never in the change feed (#2937).\n  sensitive: true,\n  // NOT tenant-scoped - this model tracks keys FOR tenants\n  api: { include: [] }, // No API exposure\n  mcp: { include: [] }, // No MCP exposure\n  // CLI runs in-process for key-rotation tooling and audit; HTTP exposure is\n  // intentionally excluded, so skipApiCheck acknowledges the divergence.\n  cli: { include: ['list', 'get'], skipApiCheck: true },\n})\nexport class TenantKey extends SmrtObject {\n  /**\n   * Tenant ID this key belongs to. Not tenant-scoped (see above), but the value\n   * is a tenant id: uuid on Postgres, like every other tenant_id column.\n   */\n  @field({ sqlType: 'UUID' })\n  tenantId: string = '';\n\n  /**\n   * Wrapped key data (format: wrappedKey:iv:authTag)\n   */\n  wrappedKey: string = '';\n\n  /**\n   * ID of the AMK used to wrap this key\n   */\n  amkKeyId: string = '';\n\n  /**\n   * Current status of the key\n   */\n  status: TenantKeyStatus = 'active';\n\n  /**\n   * Version number (increments on rotation)\n   */\n  version: number = 1;\n\n  /**\n   * Recommended rotation date\n   */\n  rotateAfter: Date | null = null;\n\n  /**\n   * When the key was retired (if applicable)\n   */\n  retiredAt: Date | null = null;\n\n  constructor(options: TenantKeyOptions = {}) {\n    super(options);\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n    if (options.wrappedKey !== undefined) this.wrappedKey = options.wrappedKey;\n    if (options.amkKeyId !== undefined) this.amkKeyId = options.amkKeyId;\n    if (options.status !== undefined) this.status = options.status;\n    if (options.version !== undefined) this.version = options.version;\n    if (options.rotateAfter !== undefined) {\n      this.rotateAfter =\n        options.rotateAfter instanceof Date\n          ? options.rotateAfter\n          : options.rotateAfter\n            ? new Date(options.rotateAfter)\n            : null;\n    }\n    if (options.retiredAt !== undefined) {\n      this.retiredAt =\n        options.retiredAt instanceof Date\n          ? options.retiredAt\n          : options.retiredAt\n            ? new Date(options.retiredAt)\n            : null;\n    }\n  }\n\n  /**\n   * Check if this key is currently active\n   */\n  isActive(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Check if this key needs rotation\n   */\n  needsRotation(): boolean {\n    if (!this.rotateAfter) return false;\n    return new Date() >= this.rotateAfter;\n  }\n\n  /**\n   * Check if this key is retired\n   */\n  isRetired(): boolean {\n    return this.status === 'retired';\n  }\n\n  /**\n   * Check if this key is compromised\n   */\n  isCompromised(): boolean {\n    return this.status === 'compromised';\n  }\n\n  /**\n   * Check if this key can be used for decryption\n   * (active or retired keys can decrypt)\n   */\n  canDecrypt(): boolean {\n    return this.status === 'active' || this.status === 'retired';\n  }\n\n  /**\n   * Check if this key can be used for encryption\n   * (only active keys should encrypt)\n   */\n  canEncrypt(): boolean {\n    return this.status === 'active';\n  }\n\n  /**\n   * Mark this key as retired\n   */\n  retire(): void {\n    this.status = 'retired';\n    this.retiredAt = new Date();\n  }\n\n  /**\n   * Mark this key as compromised\n   */\n  markCompromised(): void {\n    this.status = 'compromised';\n  }\n}\n"],"mappings":";;AAOA,eAAe,wBAAwB,KAAK,MAAM,s94BAAs94B,CAAC;;;;;;;;;;;ACgGlg5B,IAAA,iBAAA,MAAM,uBAAuB,WAAW;;;;CAI7C,WAA0B;;;;;;;CAQ1B,WAC0B;;;;CAK1B,aAAqB;;;;;;;CAQrB,SACwB;;;;CAKxB,SAA4B;;;;CAK5B,SAA4B;;;;CAK5B,YAAoB;;;;CAKpB,YAAoB;;;;CAKpB,UAAmC,CAAC;CAEpC,YAAY,UAAiC,CAAC,GAAG;EAC/C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GACvB,KAAK,WAAW,QAAQ;EAE1B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC5D;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,eAAwB;EACtB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO;GAAC;GAAU;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,MAAM;CAC5D;;;;CAKA,iBAA0B;EACxB,OAAO,KAAK,WAAW;CACzB;AACF;YAlGG,WAAW,UAAU,EAAE,YAAY,MAAM,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,KAAA,CAAA;YAc1C,gBAAgB,gCAAgC,CAAA,GAAA,eAAA,WAAA,UAAA,KAAA,CAAA;6BAlClD,KAAK;CACJ,cAAc;CACd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,cAAA;AAiHD,IAAM,eACJ;;;;AAKF,SAAgB,iBAAiB,QAUG;CAClC,MAAM,WACJ,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa,WACjD,OACA,OAAO;CASb,MAAM,YACJ,OAAO,UAAU,QAAQ,OAAO,WAAW,YAAY,OAAO,WAAW,KACrE,OACA,OAAO;CACb,MAAM,SACJ,cAAc,QAAQ,aAAa,KAAK,SAAS,IAAI,YAAY;CACnE,MAAM,UACJ,cAAc,QAAQ,WAAW,OAC7B;EAAE,GAAI,OAAO,WAAW,CAAC;EAAI,SAAS;CAAU,IAC/C,OAAO,WAAW,CAAC;CAa1B,OAAO;EAVL,UAAU,OAAO,YAAY;EAC7B,YAAY,OAAO;EACnB;EACA,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,WAAW,OAAO,aAAa;EAC/B,WAAW,OAAO,aAAa;EAC/B;EACA;CAEK;AACT;;;AC3LO,IAAA,SAAA,MAAM,eAAe,WAAW;;;;CAIrC,WAAmB;;;;CAKnB,OAAe;;;;CAKf,cAAsB;;;;CAKtB,WAAmB;;;;CAKnB,iBAAyB;;;;CAKzB,aAAqB;;;;CAKrB,SAAuB;;;;CAKvB,YAAyB;;;;CAKzB,iBAA8B;;;;CAK9B,cAAsB;;;;CAKtB,WAAoC,CAAC;CAErC,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,SAAS,KAAA,GAAW,KAAK,OAAO,QAAQ;EACpD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBAAiB,QAAQ;EAChC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;EAEV,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBACH,QAAQ,0BAA0B,OAC9B,QAAQ,iBACR,QAAQ,iBACN,IAAI,KAAK,QAAQ,cAAc,IAC/B;EAEV,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,YAAqB;EACnB,IAAI,CAAC,KAAK,WAAW,OAAO;EAC5B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,SAAS,KAAK,CAAC,KAAK,UAAU;CAC5C;;;;CAKA,eAAqB;EACnB,KAAK,iCAAiB,IAAI,KAAK;EAC/B,KAAK,eAAe;CACtB;;;;CAKA,UAAgB;EACd,KAAK,SAAS;CAChB;;;;CAKA,SAAe;EACb,KAAK,SAAS;CAChB;AACF;qBA9IC,KAAK;CAEJ,WAAW;CACX,cAAc;CAEd,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,MAAM;EAAG,cAAc;CAAK;AAC/C,CAAC,CAAA,GAAA,MAAA;;;ACHM,IAAA,YAAA,MAAM,kBAAkB,WAAW;;;;;CAKxC,WACmB;;;;CAKnB,aAAqB;;;;CAKrB,WAAmB;;;;CAKnB,SAA0B;;;;CAK1B,UAAkB;;;;CAKlB,cAA2B;;;;CAK3B,YAAyB;CAEzB,YAAY,UAA4B,CAAC,GAAG;EAC1C,MAAM,OAAO;EACb,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;EAChE,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;EAC5D,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;EAC1D,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cACH,QAAQ,uBAAuB,OAC3B,QAAQ,cACR,QAAQ,cACN,IAAI,KAAK,QAAQ,WAAW,IAC5B;EAEV,IAAI,QAAQ,cAAc,KAAA,GACxB,KAAK,YACH,QAAQ,qBAAqB,OACzB,QAAQ,YACR,QAAQ,YACN,IAAI,KAAK,QAAQ,SAAS,IAC1B;CAEZ;;;;CAKA,WAAoB;EAClB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,IAAI,CAAC,KAAK,aAAa,OAAO;EAC9B,uBAAO,IAAI,KAAK,KAAK,KAAK;CAC5B;;;;CAKA,YAAqB;EACnB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,gBAAyB;EACvB,OAAO,KAAK,WAAW;CACzB;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW;CACrD;;;;;CAMA,aAAsB;EACpB,OAAO,KAAK,WAAW;CACzB;;;;CAKA,SAAe;EACb,KAAK,SAAS;EACd,KAAK,4BAAY,IAAI,KAAK;CAC5B;;;;CAKA,kBAAwB;EACtB,KAAK,SAAS;CAChB;AACF;YArHG,MAAM,EAAE,SAAS,OAAO,CAAC,CAAA,GAAA,UAAA,WAAA,YAAA,KAAA,CAAA;wBAf3B,KAAK;CAEJ,WAAW;CAEX,KAAK,EAAE,SAAS,CAAC,EAAE;CACnB,KAAK,EAAE,SAAS,CAAC,EAAE;CAGnB,KAAK;EAAE,SAAS,CAAC,QAAQ,KAAK;EAAG,cAAc;CAAK;AACtD,CAAC,CAAA,GAAA,SAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
-import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./chunks/TenantKey-rFzuEzos.js";
-import { a as SecretAuditLogCollection, i as SecretCollection, n as SecretService, r as TenantKeyCollection, t as SecretKeyDriftError } from "./chunks/SecretService-DlnLUWgX.js";
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./chunks/TenantKey-DLV_Agrm.js";
+import { a as SecretAuditLogCollection, i as SecretCollection, n as SecretService, r as TenantKeyCollection, t as SecretKeyDriftError } from "./chunks/SecretService-BIY7s_mc.js";
 import { AMKUnavailableError, DecryptionError, EncryptionError, InvalidKeyFormatError, KeyNotFoundError, KeyRotationError, SecretError, StoreNotInitializedError, TenantKeyMissingError } from "@happyvertical/secrets";
 //#region src/index.ts
 /** @internal */

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.51.38",
+  "packageVersion": "0.52.0",
   "objects": {
     "@happyvertical/smrt-secrets:SecretAuditLogCollection": {
       "name": "secretauditlogcollection",
@@ -728,7 +728,7 @@
       "collectionExportName": "TenantKeyCollectionCollection",
       "schema": {
         "tableName": "tenant_keys",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"tenant_keys\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT DEFAULT '',\n  \"wrapped_key\" TEXT DEFAULT '',\n  \"amk_key_id\" TEXT DEFAULT '',\n  \"status\" TEXT DEFAULT 'active',\n  \"version\" INTEGER DEFAULT 1,\n  \"rotate_after\" TIMESTAMP,\n  \"retired_at\" TIMESTAMP\n);",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"tenant_keys\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" UUID,\n  \"wrapped_key\" TEXT DEFAULT '',\n  \"amk_key_id\" TEXT DEFAULT '',\n  \"status\" TEXT DEFAULT 'active',\n  \"version\" INTEGER DEFAULT 1,\n  \"rotate_after\" TIMESTAMP,\n  \"retired_at\" TIMESTAMP\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -756,10 +756,9 @@
             "default": "current_timestamp"
           },
           "tenant_id": {
-            "type": "TEXT",
+            "type": "UUID",
             "notNull": false,
-            "unique": false,
-            "default": ""
+            "unique": false
           },
           "wrapped_key": {
             "type": "TEXT",
@@ -798,12 +797,14 @@
         },
         "indexes": [
           {
-            "name": "tenant_keys_slug_context_idx",
+            "name": "tenant_keys_tenant_id_slug_idx",
             "columns": [
+              "tenant_id",
               "slug",
               "context"
             ],
-            "unique": true
+            "unique": true,
+            "nullsNotDistinct": true
           },
           {
             "name": "tenant_keys_created_at_idx",
@@ -812,7 +813,7 @@
             ]
           }
         ],
-        "version": "79fd7e46"
+        "version": "abc3474a"
       },
       "importPath": "@happyvertical/smrt-secrets"
     },
@@ -1350,7 +1351,10 @@
         "tenantId": {
           "type": "text",
           "required": false,
-          "default": ""
+          "default": "",
+          "_meta": {
+            "sqlType": "UUID"
+          }
         },
         "wrappedKey": {
           "type": "text",
@@ -1461,14 +1465,19 @@
             "get"
           ],
           "skipApiCheck": true
-        }
+        },
+        "conflictColumns": [
+          "tenant_id",
+          "slug",
+          "context"
+        ]
       },
       "extends": "SmrtObject",
       "exportName": "TenantKey",
       "collectionExportName": "TenantKeyCollection",
       "schema": {
         "tableName": "tenant_keys",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"tenant_keys\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT DEFAULT '',\n  \"wrapped_key\" TEXT DEFAULT '',\n  \"amk_key_id\" TEXT DEFAULT '',\n  \"status\" TEXT DEFAULT 'active',\n  \"version\" INTEGER DEFAULT 1,\n  \"rotate_after\" TIMESTAMP,\n  \"retired_at\" TIMESTAMP\n);",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"tenant_keys\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" UUID,\n  \"wrapped_key\" TEXT DEFAULT '',\n  \"amk_key_id\" TEXT DEFAULT '',\n  \"status\" TEXT DEFAULT 'active',\n  \"version\" INTEGER DEFAULT 1,\n  \"rotate_after\" TIMESTAMP,\n  \"retired_at\" TIMESTAMP\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -1496,10 +1505,9 @@
             "default": "current_timestamp"
           },
           "tenant_id": {
-            "type": "TEXT",
+            "type": "UUID",
             "notNull": false,
-            "unique": false,
-            "default": ""
+            "unique": false
           },
           "wrapped_key": {
             "type": "TEXT",
@@ -1538,12 +1546,14 @@
         },
         "indexes": [
           {
-            "name": "tenant_keys_slug_context_idx",
+            "name": "tenant_keys_tenant_id_slug_idx",
             "columns": [
+              "tenant_id",
               "slug",
               "context"
             ],
-            "unique": true
+            "unique": true,
+            "nullsNotDistinct": true
           },
           {
             "name": "tenant_keys_created_at_idx",
@@ -1552,7 +1562,7 @@
             ]
           }
         ],
-        "version": "79fd7e46"
+        "version": "abc3474a"
       },
       "importPath": "@happyvertical/smrt-secrets/models"
     }

package/dist/models/SecretAuditLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretAuditLog.d.ts","sourceRoot":"","sources":["../../src/models/SecretAuditLog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,UAAU,EAEX,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,qBAQa,cAAe,SAAQ,UAAU;IAC5C;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;;;;OAKG;IAEH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAM;IAExB;;;;;OAKG;IAEH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE7B;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAU;IAEnC;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAa;IAEtC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;gBAE1B,OAAO,GAAE,qBAA0B;IAe/C;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,aAAa,IAAI,OAAO;IAIxB;;OAEG;IACH,cAAc,IAAI,OAAO;CAG1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,eAAe,CAAC,cAAc,CAAC,CA2BlC"}
+{"version":3,"file":"SecretAuditLog.d.ts","sourceRoot":"","sources":["../../src/models/SecretAuditLog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,UAAU,EAEX,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,qBAQa,cAAe,SAAQ,UAAU;IAC5C;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;;;;OAKG;IAEH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAM;IAExB;;;;;OAKG;IAEH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE7B;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAU;IAEnC;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAa;IAEtC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;gBAE1B,OAAO,GAAE,qBAA0B;IAe/C;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,aAAa,IAAI,OAAO;IAIxB;;OAEG;IACH,cAAc,IAAI,OAAO;CAG1B;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,eAAe,CAAC,cAAc,CAAC,CAoClC"}

package/dist/models/TenantKey.d.ts

@@ -54,7 +54,8 @@ export interface TenantKeyOptions extends SmrtObjectOptions {
  */
 export declare class TenantKey extends SmrtObject {
     /**
-     * Tenant ID this key belongs to
+     * Tenant ID this key belongs to. Not tenant-scoped (see above), but the value
+     * is a tenant id: uuid on Postgres, like every other tenant_id column.
      */
     tenantId: string;
     /**

package/dist/models/TenantKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantKey.d.ts","sourceRoot":"","sources":["../../src/models/TenantKey.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAEhF;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AASH,qBAUa,SAAU,SAAQ,UAAU;IACvC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAM;IAEtB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAM;IAExB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAM;IAEtB;;OAEG;IACH,MAAM,EAAE,eAAe,CAAY;IAEnC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAK;IAEpB;;OAEG;IACH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAQ;IAEhC;;OAEG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAElB,OAAO,GAAE,gBAAqB;IAyB1C;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,aAAa,IAAI,OAAO;IAKxB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,aAAa,IAAI,OAAO;IAIxB;;;OAGG;IACH,UAAU,IAAI,OAAO;IAIrB;;;OAGG;IACH,UAAU,IAAI,OAAO;IAIrB;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;OAEG;IACH,eAAe,IAAI,IAAI;CAGxB"}
+{"version":3,"file":"TenantKey.d.ts","sourceRoot":"","sources":["../../src/models/TenantKey.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAS,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAEnE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAEhF;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AASH,qBAUa,SAAU,SAAQ,UAAU;IACvC;;;OAGG;IAEH,QAAQ,EAAE,MAAM,CAAM;IAEtB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAM;IAExB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAM;IAEtB;;OAEG;IACH,MAAM,EAAE,eAAe,CAAY;IAEnC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAK;IAEpB;;OAEG;IACH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAQ;IAEhC;;OAEG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAElB,OAAO,GAAE,gBAAqB;IAyB1C;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,aAAa,IAAI,OAAO;IAKxB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,aAAa,IAAI,OAAO;IAIxB;;;OAGG;IACH,UAAU,IAAI,OAAO;IAIrB;;;OAGG;IACH,UAAU,IAAI,OAAO;IAIrB;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;OAEG;IACH,eAAe,IAAI,IAAI;CAGxB"}

package/dist/models/index.js

@@ -1,2 +1,2 @@
-import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "../chunks/TenantKey-rFzuEzos.js";
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "../chunks/TenantKey-DLV_Agrm.js";
 export { Secret, SecretAuditLog, TenantKey, createAuditEntry };

package/dist/services/SecretService.js

@@ -1,2 +1,2 @@
-import { n as SecretService, t as SecretKeyDriftError } from "../chunks/SecretService-DlnLUWgX.js";
+import { n as SecretService, t as SecretKeyDriftError } from "../chunks/SecretService-BIY7s_mc.js";
 export { SecretKeyDriftError, SecretService };

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-secrets",
-  "packageVersion": "0.51.38",
+  "packageVersion": "0.52.0",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "569e96180a20acd178215c5ac4145127ff52b2edd5269f9a150f5ef8d490a18e",
-    "packageJson": "3e47824a5106cf346166e55b36ca086ba67b9b167524f8e164f5158758ad9967",
+    "manifest": "ff670efcaf008ef262add58460d0b8305ed185281a0ef19bae8aeb0288726114",
+    "packageJson": "31f97566250319dc9250d1023496bcdda1f590f54f2d6c7fa4884c4a36f90828",
     "agents": "96fe8095cb8a2673fb8752fdc2940b53ce09d83c42715396ba6812ce215e990b"
   },
   "exports": [
@@ -1211,7 +1211,7 @@
           "name": "tenantId",
           "type": "text",
           "required": false,
-          "columnType": "TEXT",
+          "columnType": "UUID",
           "default": ""
         },
         {
@@ -1300,6 +1300,11 @@
           "returns": "void"
         }
       ],
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
       "surfaces": [
         {
           "kind": "cli",
@@ -1892,7 +1897,7 @@
     "junctionCollections": 0,
     "hierarchicalObjects": 0,
     "polymorphicAssociations": 0,
-    "uuidColumns": 14
+    "uuidColumns": 16
   },
   "agentDoc": "# @happyvertical/smrt-secrets\n\nEnvelope encryption for per-tenant secret storage with key rotation and audit logging.\n\n## Encryption Architecture\n\n```\nSecret value → encrypted with TDEK (per-tenant Data Encryption Key)\n  TDEK → wrapped with AMK (Application Master Key, from env SMRT_SECRET_MASTER_KEY)\n```\n\n## Models\n\n- **Secret**: `encryptedValue` (JSON envelope), `category`, `status` (active/disabled/expired), `expiresAt`, `accessCount`, `lastAccessedAt`. **No API/MCP exposure** (security). CLI: list-only.\n- **TenantKey**: per-tenant TDEK in wrapped form. Status: active/rotating/retired/compromised. **Not tenant-scoped itself** — it tracks keys FOR tenants.\n- **SecretAuditLog**: action (create/read/update/delete/rotate_key/disable/enable), result (success/failure/denied), user/IP tracking. CLI: list-only.\n\n## SecretService\n\n| Method | Behavior |\n|--------|----------|\n| `store(name, value, options)` | Encrypt + save. Upsert if exists. Uses `context=tenantId` for per-tenant uniqueness. |\n| `retrieve(name)` | Decrypt + audit + increment accessCount |\n| `diagnoseTenantSecretKeyDrift(tenantId)` | Report active secret/key drift without exposing values. Checks `secrets`, SDK `tenant_encryption_keys`, and SMRT `tenant_keys`. |\n| `repairTenantSecretKeyDrift(tenantId, opts)` | Explicit repair path for unrecoverable drift. Use `dryRun` first; destructive cleanup requires `confirmDeleteUnrecoverableData: true`. |\n| `rotateKey()` | Create new TDEK, mark old as retired |\n| `reencryptAll()` | Decrypt with old TDEK, re-encrypt with new — **must call separately after rotateKey()** |\n| `disable(name)` / `enable(name)` | Toggle status |\n\n## Gotchas\n\n- **Key rotation doesn't auto-re-encrypt**: call `reencryptAll()` separately after `rotateKey()`\n- **retrieve() increments accessCount**: every read is tracked\n- **TenantKey NOT tenant-scoped**: it stores keys for tenants but isn't filtered by tenant context\n- **Two key tables**: `tenant_encryption_keys` is the lower-level SDK table used by `SecretService` encryption; `tenant_keys` is the SMRT model table. Drift diagnosis reports both so an empty `tenant_keys` view is not confused with missing SDK key material.\n- **Repair is destructive only by confirmation**: `repairTenantSecretKeyDrift()` deletes unrecoverable encrypted rows only when `confirmDeleteUnrecoverableData: true` is explicit. Do not silently discard encrypted secrets.\n- **Expired secrets filtered by default**: pass `includeExpired: true` to list them\n- **TenantKeyCollection.cleanupRetiredKeys()**: hard-deletes after 90 days\n- **Audit logging optional but default**: failures logged to console, not thrown\n- **Audit rows outlive secrets**: `SecretAuditLog.secretId` uses the explicit\n  same-package app-side-only FK option. It retains relationship metadata and an\n  index, but emits no physical constraint because compliance logs are retained\n  for 1-7 years while secrets may be deleted or purged during key-drift repair.\n\n## Known exceptions to monorepo standards\n\nPer `docs/content/standards.md §7`, tenant-aware models should normally apply\n`@TenantScoped({ mode: 'optional' })` from `@happyvertical/smrt-tenancy`. The three\nmodels in this package deviate intentionally; each `@smrt(...)` block carries an\ninline comment pointing back to this section.\n\n- **`Secret` (`src/models/Secret.ts`)** — uses the inline `tenantScoped: true` form\n  on `@smrt()` instead of the `@TenantScoped` decorator. `SecretService.store()`\n  performs manual scoping by populating `context = tenantId` on each row, so the\n  `(slug, context)` upsert key from the base `SmrtObject` is what isolates secret\n  names per tenant. Switching to the decorator without rethinking the upsert key\n  would surface false-positive name collisions across tenants.\n- **`TenantKey` (`src/models/TenantKey.ts`)** — deliberately NOT tenant-scoped at\n  all. The row carries a `tenantId` column because each TDEK belongs to a tenant,\n  but key-rotation tooling, AMK rewrap jobs, and super-admin audits must query\n  across tenants; the tenancy interceptor would silently filter rows those flows\n  rely on.\n- **`SecretAuditLog` (`src/models/SecretAuditLog.ts`)** — uses the inline\n  `tenantScoped: true` form rather than the decorator. Audit reads run in mixed\n  contexts (tenant-scoped reports vs. super-admin compliance review). Cross-\n  tenant audit queries should be wrapped in `withSuperAdminBypass()` from\n  `@happyvertical/smrt-tenancy` at the call site — there are no such cross-\n  tenant call sites in this package today, but consumers building compliance\n  tooling should adopt that pattern explicitly rather than relying on\n  decorator-implicit filtering. Its `secretId` relationship is also deliberately\n  app-side-only so immutable audit history can survive deletion of the secret.\n"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-secrets",
-  "version": "0.51.38",
+  "version": "0.52.0",
   "description": "Per-tenant secret management with envelope encryption for SMRT",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,15 +27,15 @@
     }
   },
   "dependencies": {
-    "@happyvertical/logger": "^0.96.0",
-    "@happyvertical/secrets": "^0.96.0",
-    "@happyvertical/smrt-core": "0.51.38",
-    "@happyvertical/smrt-tenancy": "0.51.38",
-    "@happyvertical/sql": "^0.96.0",
-    "@happyvertical/utils": "^0.96.0"
+    "@happyvertical/logger": "^0.96.1",
+    "@happyvertical/secrets": "^0.96.1",
+    "@happyvertical/smrt-core": "0.52.0",
+    "@happyvertical/smrt-tenancy": "0.52.0",
+    "@happyvertical/sql": "^0.96.1",
+    "@happyvertical/utils": "^0.96.1"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.51.38",
+    "@happyvertical/smrt-vitest": "0.52.0",
     "@types/node": "24.13.6",
     "typescript": "6.0.3",
     "vite": "8.1.4",