@mstone6969/vault 0.2.0 → 0.5.0

package/dist/stores/memory.d.ts

@@ -1,16 +1,107 @@
 import type { SecretRecord, VaultStore } from "../types";
-/** Keeps sealed values in a Map. Handy for tests and short-lived processes. */
+/**
+ * Keeps sealed values in a Map. Handy for tests and short-lived processes.
+ *
+ * Nothing is written anywhere: when the process ends every record goes with it.
+ * That is the point — a test gets a clean vault per run without a file to
+ * create and delete, and a short-lived worker holding a few credentials in
+ * memory leaves nothing behind on disk.
+ *
+ * @remarks
+ * Like every {@link VaultStore}, this persists records exactly as given and
+ * enforces nothing: finality, expiry and history are rules the {@link Vault}
+ * applies before it calls {@link MemoryStore.put}.
+ * @example
+ * ```ts
+ * import { generateKey, MemoryStore, Vault } from "@mstone6969/vault"
+ *
+ * const vault = new Vault({ key: generateKey(), store: new MemoryStore() })
+ * await vault.put("alice", "db-password", "hunter2")
+ * ```
+ * @see {@link FileStore} for a store that survives the process.
+ */
 export declare class MemoryStore implements VaultStore {
+    /** Records by `owner name`, the key {@link MemoryStore.key} builds. */
     private readonly records;
+    /**
+     * Makes an empty store.
+     *
+     * @remarks
+     * Takes nothing: there is no file to name and no key to hand it, since
+     * records never leave the process.
+     * @example
+     * ```ts
+     * import { MemoryStore } from "@mstone6969/vault"
+     *
+     * const store = new MemoryStore()
+     * ```
+     */
+    constructor();
+    /**
+     * The Map key for one entry: owners are separate namespaces, so the name
+     * alone is not unique.
+     *
+     * @param owner Whose entry it is.
+     * @param name What the entry is called.
+     * @returns The two joined by a space.
+     */
     private static key;
+    /**
+     * One record, or null when there is none under that name.
+     *
+     * @param owner Whose entry to look for.
+     * @param name What the entry is called.
+     * @returns The stored record, or null if this owner has nothing by that
+     *   name. The record itself is returned, not a copy, so callers must not
+     *   mutate it.
+     * @example
+     * ```ts
+     * import { MemoryStore } from "@mstone6969/vault"
+     *
+     * const store = new MemoryStore()
+     * const record = await store.get("alice", "db-password") // null
+     * ```
+     */
     get(owner: string, name: string): Promise<SecretRecord | null>;
+    /**
+     * Every record one owner holds.
+     *
+     * @param owner Whose entries to return.
+     * @returns That owner's records, in no particular order — the vault's
+     *   `list` sorts them. Empty for an owner the store has never heard of.
+     * @see {@link MemoryStore.all} when the caller needs every owner's records.
+     */
     list(owner: string): Promise<SecretRecord[]>;
-    put(record: {
-        owner: string;
-        name: string;
-        sealed: string;
-        metadata: Record<string, string>;
-    }): Promise<SecretRecord>;
+    /**
+     * Every record, whoever owns it.
+     *
+     * @returns All records the store holds, in no particular order.
+     * @remarks
+     * This is the only place anything reaches across owners, and it exists for
+     * the vault-wide operations — `rekey`, `reseal` and `purgeExpired` — which
+     * have to touch every entry. Ordinary reads go through
+     * {@link MemoryStore.list}.
+     */
+    all(): Promise<SecretRecord[]>;
+    /**
+     * Writes a record, replacing any under the same owner and name.
+     *
+     * @param record The record to keep, stored as given.
+     * @returns The same record, so a caller can write and use the result in one
+     *   step.
+     * @remarks
+     * An `isFinal` record is replaced here without complaint: refusing that is
+     * the vault's job, and it checks before it calls this.
+     */
+    put(record: SecretRecord): Promise<SecretRecord>;
+    /**
+     * Deletes a record, returning false when there was nothing to delete.
+     *
+     * @param owner Whose entry to delete.
+     * @param name What the entry is called.
+     * @returns True if a record was removed, false if there was none — so a
+     *   caller can tell a delete from a no-op.
+     */
     remove(owner: string, name: string): Promise<boolean>;
 }
 //# sourceMappingURL=memory.d.ts.map

package/dist/stores/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAExD,+EAA+E;AAC/E,qBAAa,WAAY,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D,OAAO,CAAC,MAAM,CAAC,GAAG;IAIZ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAI9D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI5C,GAAG,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACnC,GAAG,OAAO,CAAC,YAAY,CAAC;IAanB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9D"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,WAAY,YAAW,UAAU;IAC1C,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD;;;;;;;;;;;;OAYG;;IAKH;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,GAAG;IAIlB;;;;;;;;;;;;;;;OAeG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIpE;;;;;;;OAOG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIlD;;;;;;;;;OASG;IACG,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIpC;;;;;;;;;OASG;IACG,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAKtD;;;;;;;OAOG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9D"}

package/dist/stores/sqlite.d.ts

@@ -1,24 +1,155 @@
 import { Database } from "bun:sqlite";
 import type { SecretRecord, VaultStore } from "../types";
 /**
- * Keeps sealed values in SQLite through `bun:sqlite`. Pass a file path,
- * ":memory:", or a Database you already opened.
+ * Keeps records in SQLite through `bun:sqlite`. Pass a file path, ":memory:",
+ * or a Database you already opened.
+ *
+ * Values are sealed, but owners, names and metadata are ordinary columns —
+ * anyone who can read the file learns what you keep, if not what it says. Use
+ * `FileStore` when even that should be hidden.
+ *
+ * @remarks
+ * `bun:sqlite` makes this store Bun-only: importing it on Node fails at the
+ * import, not at the first query. That is why it is reached through
+ * `@mstone6969/vault/stores/sqlite` instead of the package's main entry —
+ * a Node program that imports the main entry never loads this file, and never
+ * sees the Bun-only import.
+ *
+ * Every method is `async` only to satisfy {@link VaultStore}; `bun:sqlite` is
+ * synchronous, so nothing here waits on I/O.
+ *
+ * @example
+ * ```ts
+ * import { Vault } from "@mstone6969/vault"
+ * import { SqliteStore } from "@mstone6969/vault/stores/sqlite"
+ *
+ * const store = new SqliteStore("./vault.sqlite")
+ * const vault = new Vault({ key: process.env.VAULT_KEY!, store })
+ *
+ * await vault.put("alice", "db-password", "hunter2", {
+ *     metadata: { kind: "postgres" },
+ * })
+ * console.log(await vault.open("alice", "db-password")) // "hunter2"
+ * store.close()
+ * ```
+ *
+ * @see {@link VaultStore} for what a store owes the vault.
  */
 export declare class SqliteStore implements VaultStore {
     private readonly db;
     private readonly table;
+    /**
+     * Opens the database if it was given a path, and makes sure the table is
+     * there and current.
+     *
+     * The table is created in its 0.1.0 shape if it is missing, and then every
+     * column added since — `sealed_key`, `plain`, `is_sealed`, `is_final`,
+     * `expires_at`, `history`, `rotation`, `rotated_at`, `metadata` — is
+     * ALTERed in if it is absent. So a table written by an older version of
+     * the package is upgraded the moment a newer one opens it, in place and
+     * without a migration step of your own, and rows that predate a column
+     * read back with sensible defaults: no history, no metadata, sealed, not
+     * final, no expiry.
+     *
+     * @param database A file path to open, ":memory:" for a database that
+     *   lasts as long as the process, or a `Database` you already opened —
+     *   useful for keeping the vault's table beside your own in one file, and
+     *   inside your own transactions.
+     * @defaultValue `":memory:"`
+     * @param table Which table to keep records in. Give it a name of its own
+     *   when one database holds several vaults.
+     * @defaultValue `"vault_secrets"`
+     * @throws Whatever `bun:sqlite` throws when the path cannot be opened, or
+     *   when `table` already exists with an incompatible shape.
+     *
+     * @example Sharing a database you already opened
+     * ```ts
+     * import { Database } from "bun:sqlite"
+     * import { SqliteStore } from "@mstone6969/vault/stores/sqlite"
+     *
+     * const db = new Database("./app.sqlite")
+     * const store = new SqliteStore(db, "shared_secrets")
+     * ```
+     */
     constructor(database?: string | Database, table?: string);
+    /**
+     * Turns a row back into a record: JSON columns parsed, epoch milliseconds
+     * back into `Date`, integers back into booleans.
+     *
+     * Every column added after 0.1.0 is read defensively, because a row
+     * written before that column existed reads back as null.
+     *
+     * @param row One row of {@link SqliteStore}'s table, as SQLite returns it.
+     * @returns The record that row stands for.
+     */
     private static toRecord;
+    /**
+     * One record, or null when there is none under that name.
+     *
+     * The record carries the sealed value, not the plaintext: use
+     * `Vault.open` to get a value back out.
+     *
+     * @param owner Whose entry to look for.
+     * @param name The entry's name.
+     * @returns The stored record, or null when that owner has nothing under
+     *   that name.
+     */
     get(owner: string, name: string): Promise<SecretRecord | null>;
+    /**
+     * Every record one owner holds, in whatever order SQLite returns them —
+     * the vault sorts what it shows.
+     *
+     * @param owner Whose entries to return.
+     * @returns That owner's records, empty when they hold none.
+     */
     list(owner: string): Promise<SecretRecord[]>;
-    put(record: {
-        owner: string;
-        name: string;
-        sealed: string;
-        metadata: Record<string, string>;
-    }): Promise<SecretRecord>;
+    /**
+     * Every record, whoever owns it.
+     *
+     * Only `Vault.rekey` and `Vault.purgeExpired` need this;
+     * everything else stays inside one owner. It loads the whole table, so it
+     * is the one method that costs more as the vault grows.
+     *
+     * @returns Every record in the table.
+     */
+    all(): Promise<SecretRecord[]>;
+    /**
+     * Writes a record, replacing any under the same owner and name.
+     *
+     * `created_at` is deliberately left out of the conflict update: a
+     * replacement keeps the moment the entry first appeared. Nothing here
+     * enforces finality or expiry — those are the vault's rules, and the store
+     * writes what it is given.
+     *
+     * @param record The record to write. `owner` and `name` are its key.
+     * @returns The record as it reads back out of SQLite, which is what
+     *   callers should keep — dates have been through epoch milliseconds and
+     *   JSON columns through a round trip.
+     * @throws Error if the row cannot be read back immediately after writing
+     *   it, which means the database is not behaving as SQLite.
+     */
+    put(record: SecretRecord): Promise<SecretRecord>;
+    /**
+     * Deletes a record, returning false when there was nothing to delete.
+     *
+     * History goes with it: the row holds the previous values, so deleting an
+     * entry deletes every version of it.
+     *
+     * @param owner Whose entry to delete.
+     * @param name The entry's name.
+     * @returns True when a record was there and is now gone, false when there
+     *   was nothing under that name.
+     */
     remove(owner: string, name: string): Promise<boolean>;
-    /** Closes the underlying database. */
+    /**
+     * Closes the underlying database.
+     *
+     * This closes a `Database` you passed to the constructor as well — the
+     * store does not track who opened it, so anything else using that same
+     * handle stops working too. Call it on the owner of the connection only.
+     *
+     * @returns Nothing; the store is unusable afterwards.
+     */
     close(): void;
 }
 //# sourceMappingURL=sqlite.d.ts.map

package/dist/stores/sqlite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/stores/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAWxD;;;GAGG;AACH,qBAAa,WAAY,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,QAAQ,GAAE,MAAM,GAAG,QAAqB,EAAE,KAAK,SAAkB;IAuB7E,OAAO,CAAC,MAAM,CAAC,QAAQ;IAWjB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAS9D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAO5C,GAAG,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACnC,GAAG,OAAO,CAAC,YAAY,CAAC;IAyBnB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS3D,sCAAsC;IACtC,KAAK,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/stores/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,KAAK,EAAgB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAgCtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,WAAY,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;gBACS,QAAQ,GAAE,MAAM,GAAG,QAAqB,EAAE,KAAK,SAAkB;IA2B7E;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IA2BvB;;;;;;;;;;OAUG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IASpE;;;;;;OAMG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAOlD;;;;;;;;OAQG;IACG,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAOpC;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IA2CtD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D;;;;;;;;OAQG;IACH,KAAK,IAAI,IAAI;CAGhB"}

package/dist/stores/sqlite.js

@@ -1,6 +1,17 @@
 // @bun
 // src/stores/sqlite.ts
 import { Database } from "bun:sqlite";
+var LATER_COLUMNS = [
+  ["sealed_key", "TEXT"],
+  ["plain", "TEXT"],
+  ["is_sealed", "INTEGER NOT NULL DEFAULT 1"],
+  ["is_final", "INTEGER NOT NULL DEFAULT 0"],
+  ["expires_at", "INTEGER"],
+  ["history", "TEXT"],
+  ["rotation", "TEXT"],
+  ["rotated_at", "INTEGER"],
+  ["metadata", "TEXT"]
+];
 
 class SqliteStore {
   db;
@@ -12,21 +23,31 @@ class SqliteStore {
                 owner TEXT NOT NULL,
                 name TEXT NOT NULL,
                 sealed TEXT NOT NULL,
-                metadata TEXT,
                 created_at INTEGER NOT NULL,
                 updated_at INTEGER NOT NULL,
                 PRIMARY KEY (owner, name)
             )`);
-    const columns = this.db.query(`PRAGMA table_info(${this.table})`).all();
-    if (!columns.some((column) => column.name === "metadata")) {
-      this.db.run(`ALTER TABLE ${this.table} ADD COLUMN metadata TEXT`);
+    const present = new Set(this.db.query(`PRAGMA table_info(${this.table})`).all().map((column) => column.name));
+    for (const [column, type] of LATER_COLUMNS) {
+      if (!present.has(column)) {
+        this.db.run(`ALTER TABLE ${this.table} ADD COLUMN ${column} ${type}`);
+      }
     }
   }
   static toRecord(row) {
+    const history = row.history ? JSON.parse(row.history).map((entry) => ({ ...entry, createdAt: new Date(entry.createdAt) })) : [];
     return {
       owner: row.owner,
       name: row.name,
       sealed: row.sealed,
+      sealedKey: row.sealed_key,
+      plain: row.plain,
+      isSealed: row.is_sealed !== 0,
+      isFinal: row.is_final !== 0,
+      expiresAt: row.expires_at === null ? null : new Date(row.expires_at),
+      history,
+      rotation: row.rotation ? JSON.parse(row.rotation) : null,
+      rotatedAt: row.rotated_at === null ? null : new Date(row.rotated_at),
       metadata: row.metadata ? JSON.parse(row.metadata) : {},
       createdAt: new Date(row.created_at),
       updatedAt: new Date(row.updated_at)
@@ -39,16 +60,30 @@ class SqliteStore {
   async list(owner) {
     return this.db.query(`SELECT * FROM ${this.table} WHERE owner = ?`).all(owner).map(SqliteStore.toRecord);
   }
+  async all() {
+    return this.db.query(`SELECT * FROM ${this.table}`).all().map(SqliteStore.toRecord);
+  }
   async put(record) {
-    const now = Date.now();
-    this.db.query(`INSERT INTO ${this.table} (owner, name, sealed, metadata, created_at, updated_at)
-                 VALUES (?, ?, ?, ?, ?, ?)
-                 ON CONFLICT(owner, name)
-                 DO UPDATE SET sealed = excluded.sealed, metadata = excluded.metadata,
-                               updated_at = excluded.updated_at`).run(record.owner, record.name, record.sealed, JSON.stringify(record.metadata), now, now);
+    this.db.query(`INSERT INTO ${this.table}
+                    (owner, name, sealed, sealed_key, plain, is_sealed, is_final,
+                     expires_at, history, rotation, rotated_at, metadata,
+                     created_at, updated_at)
+                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                 ON CONFLICT(owner, name) DO UPDATE SET
+                    sealed = excluded.sealed,
+                    sealed_key = excluded.sealed_key,
+                    plain = excluded.plain,
+                    is_sealed = excluded.is_sealed,
+                    is_final = excluded.is_final,
+                    expires_at = excluded.expires_at,
+                    history = excluded.history,
+                    rotation = excluded.rotation,
+                    rotated_at = excluded.rotated_at,
+                    metadata = excluded.metadata,
+                    updated_at = excluded.updated_at`).run(record.owner, record.name, record.sealed, record.sealedKey, record.plain, record.isSealed ? 1 : 0, record.isFinal ? 1 : 0, record.expiresAt?.getTime() ?? null, JSON.stringify(record.history), record.rotation ? JSON.stringify(record.rotation) : null, record.rotatedAt?.getTime() ?? null, JSON.stringify(record.metadata), record.createdAt.getTime(), record.updatedAt.getTime());
     const stored = await this.get(record.owner, record.name);
     if (!stored)
-      throw new Error("The secret vanished immediately after writing it.");
+      throw new Error("The record vanished immediately after writing it.");
     return stored;
   }
   async remove(owner, name) {
@@ -66,5 +101,5 @@ export {
   SqliteStore
 };
 
-//# debugId=6FCBF9C9F6B3EDC164756E2164756E21
+//# debugId=850E2DEC0A204F1364756E2164756E21
 //# sourceMappingURL=sqlite.js.map

package/dist/stores/sqlite.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../../src/stores/sqlite.ts"],
   "sourcesContent": [
-    "import { Database } from \"bun:sqlite\"\nimport type { SecretRecord, VaultStore } from \"../types\"\n\ntype Row = {\n    owner: string\n    name: string\n    sealed: string\n    metadata: string | null\n    created_at: number\n    updated_at: number\n}\n\n/**\n * Keeps sealed values in SQLite through `bun:sqlite`. Pass a file path,\n * \":memory:\", or a Database you already opened.\n */\nexport class SqliteStore implements VaultStore {\n    private readonly db: Database\n    private readonly table: string\n\n    constructor(database: string | Database = \":memory:\", table = \"vault_secrets\") {\n        this.db = typeof database === \"string\" ? new Database(database) : database\n        this.table = table\n        this.db.run(\n            `CREATE TABLE IF NOT EXISTS ${this.table} (\n                owner TEXT NOT NULL,\n                name TEXT NOT NULL,\n                sealed TEXT NOT NULL,\n                metadata TEXT,\n                created_at INTEGER NOT NULL,\n                updated_at INTEGER NOT NULL,\n                PRIMARY KEY (owner, name)\n            )`\n        )\n        // A table written by an earlier version has no metadata column.\n        const columns = this.db\n            .query<{ name: string }, []>(`PRAGMA table_info(${this.table})`)\n            .all()\n        if (!columns.some((column) => column.name === \"metadata\")) {\n            this.db.run(`ALTER TABLE ${this.table} ADD COLUMN metadata TEXT`)\n        }\n    }\n\n    private static toRecord(row: Row): SecretRecord {\n        return {\n            owner: row.owner,\n            name: row.name,\n            sealed: row.sealed,\n            metadata: row.metadata ? (JSON.parse(row.metadata) as Record<string, string>) : {},\n            createdAt: new Date(row.created_at),\n            updatedAt: new Date(row.updated_at),\n        }\n    }\n\n    async get(owner: string, name: string): Promise<SecretRecord | null> {\n        const row = this.db\n            .query<Row, [string, string]>(\n                `SELECT * FROM ${this.table} WHERE owner = ? AND name = ?`\n            )\n            .get(owner, name)\n        return row ? SqliteStore.toRecord(row) : null\n    }\n\n    async list(owner: string): Promise<SecretRecord[]> {\n        return this.db\n            .query<Row, [string]>(`SELECT * FROM ${this.table} WHERE owner = ?`)\n            .all(owner)\n            .map(SqliteStore.toRecord)\n    }\n\n    async put(record: {\n        owner: string\n        name: string\n        sealed: string\n        metadata: Record<string, string>\n    }): Promise<SecretRecord> {\n        const now = Date.now()\n        // Replacing a value keeps the row's original created_at.\n        this.db\n            .query(\n                `INSERT INTO ${this.table} (owner, name, sealed, metadata, created_at, updated_at)\n                 VALUES (?, ?, ?, ?, ?, ?)\n                 ON CONFLICT(owner, name)\n                 DO UPDATE SET sealed = excluded.sealed, metadata = excluded.metadata,\n                               updated_at = excluded.updated_at`\n            )\n            .run(\n                record.owner,\n                record.name,\n                record.sealed,\n                JSON.stringify(record.metadata),\n                now,\n                now\n            )\n\n        const stored = await this.get(record.owner, record.name)\n        if (!stored) throw new Error(\"The secret vanished immediately after writing it.\")\n        return stored\n    }\n\n    async remove(owner: string, name: string): Promise<boolean> {\n        const existing = await this.get(owner, name)\n        if (!existing) return false\n        this.db\n            .query(`DELETE FROM ${this.table} WHERE owner = ? AND name = ?`)\n            .run(owner, name)\n        return true\n    }\n\n    /** Closes the underlying database. */\n    close(): void {\n        this.db.close()\n    }\n}\n"
+    "import { Database } from \"bun:sqlite\"\nimport type { HistoryEntry, SecretRecord, VaultStore } from \"../types\"\n\ntype Row = {\n    owner: string\n    name: string\n    sealed: string\n    sealed_key: string | null\n    plain: string | null\n    is_sealed: number\n    is_final: number\n    expires_at: number | null\n    history: string | null\n    rotation: string | null\n    rotated_at: number | null\n    metadata: string | null\n    created_at: number\n    updated_at: number\n}\n\n/** Columns added after 0.1.0, applied to tables that predate them. */\nconst LATER_COLUMNS: [string, string][] = [\n    [\"sealed_key\", \"TEXT\"],\n    [\"plain\", \"TEXT\"],\n    [\"is_sealed\", \"INTEGER NOT NULL DEFAULT 1\"],\n    [\"is_final\", \"INTEGER NOT NULL DEFAULT 0\"],\n    [\"expires_at\", \"INTEGER\"],\n    [\"history\", \"TEXT\"],\n    [\"rotation\", \"TEXT\"],\n    [\"rotated_at\", \"INTEGER\"],\n    [\"metadata\", \"TEXT\"],\n]\n\n/**\n * Keeps records in SQLite through `bun:sqlite`. Pass a file path, \":memory:\",\n * or a Database you already opened.\n *\n * Values are sealed, but owners, names and metadata are ordinary columns —\n * anyone who can read the file learns what you keep, if not what it says. Use\n * `FileStore` when even that should be hidden.\n *\n * @remarks\n * `bun:sqlite` makes this store Bun-only: importing it on Node fails at the\n * import, not at the first query. That is why it is reached through\n * `@mstone6969/vault/stores/sqlite` instead of the package's main entry —\n * a Node program that imports the main entry never loads this file, and never\n * sees the Bun-only import.\n *\n * Every method is `async` only to satisfy {@link VaultStore}; `bun:sqlite` is\n * synchronous, so nothing here waits on I/O.\n *\n * @example\n * ```ts\n * import { Vault } from \"@mstone6969/vault\"\n * import { SqliteStore } from \"@mstone6969/vault/stores/sqlite\"\n *\n * const store = new SqliteStore(\"./vault.sqlite\")\n * const vault = new Vault({ key: process.env.VAULT_KEY!, store })\n *\n * await vault.put(\"alice\", \"db-password\", \"hunter2\", {\n *     metadata: { kind: \"postgres\" },\n * })\n * console.log(await vault.open(\"alice\", \"db-password\")) // \"hunter2\"\n * store.close()\n * ```\n *\n * @see {@link VaultStore} for what a store owes the vault.\n */\nexport class SqliteStore implements VaultStore {\n    private readonly db: Database\n    private readonly table: string\n\n    /**\n     * Opens the database if it was given a path, and makes sure the table is\n     * there and current.\n     *\n     * The table is created in its 0.1.0 shape if it is missing, and then every\n     * column added since — `sealed_key`, `plain`, `is_sealed`, `is_final`,\n     * `expires_at`, `history`, `rotation`, `rotated_at`, `metadata` — is\n     * ALTERed in if it is absent. So a table written by an older version of\n     * the package is upgraded the moment a newer one opens it, in place and\n     * without a migration step of your own, and rows that predate a column\n     * read back with sensible defaults: no history, no metadata, sealed, not\n     * final, no expiry.\n     *\n     * @param database A file path to open, \":memory:\" for a database that\n     *   lasts as long as the process, or a `Database` you already opened —\n     *   useful for keeping the vault's table beside your own in one file, and\n     *   inside your own transactions.\n     * @defaultValue `\":memory:\"`\n     * @param table Which table to keep records in. Give it a name of its own\n     *   when one database holds several vaults.\n     * @defaultValue `\"vault_secrets\"`\n     * @throws Whatever `bun:sqlite` throws when the path cannot be opened, or\n     *   when `table` already exists with an incompatible shape.\n     *\n     * @example Sharing a database you already opened\n     * ```ts\n     * import { Database } from \"bun:sqlite\"\n     * import { SqliteStore } from \"@mstone6969/vault/stores/sqlite\"\n     *\n     * const db = new Database(\"./app.sqlite\")\n     * const store = new SqliteStore(db, \"shared_secrets\")\n     * ```\n     */\n    constructor(database: string | Database = \":memory:\", table = \"vault_secrets\") {\n        this.db = typeof database === \"string\" ? new Database(database) : database\n        this.table = table\n        this.db.run(\n            `CREATE TABLE IF NOT EXISTS ${this.table} (\n                owner TEXT NOT NULL,\n                name TEXT NOT NULL,\n                sealed TEXT NOT NULL,\n                created_at INTEGER NOT NULL,\n                updated_at INTEGER NOT NULL,\n                PRIMARY KEY (owner, name)\n            )`\n        )\n\n        const present = new Set(\n            this.db\n                .query<{ name: string }, []>(`PRAGMA table_info(${this.table})`)\n                .all()\n                .map((column) => column.name)\n        )\n        for (const [column, type] of LATER_COLUMNS) {\n            if (!present.has(column)) {\n                this.db.run(`ALTER TABLE ${this.table} ADD COLUMN ${column} ${type}`)\n            }\n        }\n    }\n\n    /**\n     * Turns a row back into a record: JSON columns parsed, epoch milliseconds\n     * back into `Date`, integers back into booleans.\n     *\n     * Every column added after 0.1.0 is read defensively, because a row\n     * written before that column existed reads back as null.\n     *\n     * @param row One row of {@link SqliteStore}'s table, as SQLite returns it.\n     * @returns The record that row stands for.\n     */\n    private static toRecord(row: Row): SecretRecord {\n        const history: HistoryEntry[] = row.history\n            ? (JSON.parse(row.history) as { sealed: string; sealedKey: string | null; createdAt: string }[]).map(\n                  (entry) => ({ ...entry, createdAt: new Date(entry.createdAt) })\n              )\n            : []\n\n        return {\n            owner: row.owner,\n            name: row.name,\n            sealed: row.sealed,\n            sealedKey: row.sealed_key,\n            plain: row.plain,\n            isSealed: row.is_sealed !== 0,\n            isFinal: row.is_final !== 0,\n            expiresAt: row.expires_at === null ? null : new Date(row.expires_at),\n            history,\n            rotation: row.rotation\n                ? (JSON.parse(row.rotation) as SecretRecord[\"rotation\"])\n                : null,\n            rotatedAt: row.rotated_at === null ? null : new Date(row.rotated_at),\n            metadata: row.metadata ? (JSON.parse(row.metadata) as Record<string, string>) : {},\n            createdAt: new Date(row.created_at),\n            updatedAt: new Date(row.updated_at),\n        }\n    }\n\n    /**\n     * One record, or null when there is none under that name.\n     *\n     * The record carries the sealed value, not the plaintext: use\n     * `Vault.open` to get a value back out.\n     *\n     * @param owner Whose entry to look for.\n     * @param name The entry's name.\n     * @returns The stored record, or null when that owner has nothing under\n     *   that name.\n     */\n    async get(owner: string, name: string): Promise<SecretRecord | null> {\n        const row = this.db\n            .query<Row, [string, string]>(\n                `SELECT * FROM ${this.table} WHERE owner = ? AND name = ?`\n            )\n            .get(owner, name)\n        return row ? SqliteStore.toRecord(row) : null\n    }\n\n    /**\n     * Every record one owner holds, in whatever order SQLite returns them —\n     * the vault sorts what it shows.\n     *\n     * @param owner Whose entries to return.\n     * @returns That owner's records, empty when they hold none.\n     */\n    async list(owner: string): Promise<SecretRecord[]> {\n        return this.db\n            .query<Row, [string]>(`SELECT * FROM ${this.table} WHERE owner = ?`)\n            .all(owner)\n            .map(SqliteStore.toRecord)\n    }\n\n    /**\n     * Every record, whoever owns it.\n     *\n     * Only `Vault.rekey` and `Vault.purgeExpired` need this;\n     * everything else stays inside one owner. It loads the whole table, so it\n     * is the one method that costs more as the vault grows.\n     *\n     * @returns Every record in the table.\n     */\n    async all(): Promise<SecretRecord[]> {\n        return this.db\n            .query<Row, []>(`SELECT * FROM ${this.table}`)\n            .all()\n            .map(SqliteStore.toRecord)\n    }\n\n    /**\n     * Writes a record, replacing any under the same owner and name.\n     *\n     * `created_at` is deliberately left out of the conflict update: a\n     * replacement keeps the moment the entry first appeared. Nothing here\n     * enforces finality or expiry — those are the vault's rules, and the store\n     * writes what it is given.\n     *\n     * @param record The record to write. `owner` and `name` are its key.\n     * @returns The record as it reads back out of SQLite, which is what\n     *   callers should keep — dates have been through epoch milliseconds and\n     *   JSON columns through a round trip.\n     * @throws Error if the row cannot be read back immediately after writing\n     *   it, which means the database is not behaving as SQLite.\n     */\n    async put(record: SecretRecord): Promise<SecretRecord> {\n        this.db\n            .query(\n                `INSERT INTO ${this.table}\n                    (owner, name, sealed, sealed_key, plain, is_sealed, is_final,\n                     expires_at, history, rotation, rotated_at, metadata,\n                     created_at, updated_at)\n                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n                 ON CONFLICT(owner, name) DO UPDATE SET\n                    sealed = excluded.sealed,\n                    sealed_key = excluded.sealed_key,\n                    plain = excluded.plain,\n                    is_sealed = excluded.is_sealed,\n                    is_final = excluded.is_final,\n                    expires_at = excluded.expires_at,\n                    history = excluded.history,\n                    rotation = excluded.rotation,\n                    rotated_at = excluded.rotated_at,\n                    metadata = excluded.metadata,\n                    updated_at = excluded.updated_at`\n            )\n            .run(\n                record.owner,\n                record.name,\n                record.sealed,\n                record.sealedKey,\n                record.plain,\n                record.isSealed ? 1 : 0,\n                record.isFinal ? 1 : 0,\n                record.expiresAt?.getTime() ?? null,\n                JSON.stringify(record.history),\n                record.rotation ? JSON.stringify(record.rotation) : null,\n                record.rotatedAt?.getTime() ?? null,\n                JSON.stringify(record.metadata),\n                record.createdAt.getTime(),\n                record.updatedAt.getTime()\n            )\n\n        const stored = await this.get(record.owner, record.name)\n        if (!stored) throw new Error(\"The record vanished immediately after writing it.\")\n        return stored\n    }\n\n    /**\n     * Deletes a record, returning false when there was nothing to delete.\n     *\n     * History goes with it: the row holds the previous values, so deleting an\n     * entry deletes every version of it.\n     *\n     * @param owner Whose entry to delete.\n     * @param name The entry's name.\n     * @returns True when a record was there and is now gone, false when there\n     *   was nothing under that name.\n     */\n    async remove(owner: string, name: string): Promise<boolean> {\n        const existing = await this.get(owner, name)\n        if (!existing) return false\n        this.db.query(`DELETE FROM ${this.table} WHERE owner = ? AND name = ?`).run(owner, name)\n        return true\n    }\n\n    /**\n     * Closes the underlying database.\n     *\n     * This closes a `Database` you passed to the constructor as well — the\n     * store does not track who opened it, so anything else using that same\n     * handle stops working too. Call it on the owner of the connection only.\n     *\n     * @returns Nothing; the store is unusable afterwards.\n     */\n    close(): void {\n        this.db.close()\n    }\n}\n"
   ],
-  "mappings": ";;AAAA;AAAA;AAgBO,MAAM,YAAkC;AAAA,EAC1B;AAAA,EACA;AAAA,EAEjB,WAAW,CAAC,WAA8B,YAAY,QAAQ,iBAAiB;AAAA,IAC3E,KAAK,KAAK,OAAO,aAAa,WAAW,IAAI,SAAS,QAAQ,IAAI;AAAA,IAClE,KAAK,QAAQ;AAAA,IACb,KAAK,GAAG,IACJ,8BAA8B,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cASvC;AAAA,IAEA,MAAM,UAAU,KAAK,GAChB,MAA4B,qBAAqB,KAAK,QAAQ,EAC9D,IAAI;AAAA,IACT,IAAI,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,UAAU,GAAG;AAAA,MACvD,KAAK,GAAG,IAAI,eAAe,KAAK,gCAAgC;AAAA,IACpE;AAAA;AAAA,SAGW,QAAQ,CAAC,KAAwB;AAAA,IAC5C,OAAO;AAAA,MACH,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,UAAU,IAAI,WAAY,KAAK,MAAM,IAAI,QAAQ,IAA+B,CAAC;AAAA,MACjF,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,MAClC,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,IACtC;AAAA;AAAA,OAGE,IAAG,CAAC,OAAe,MAA4C;AAAA,IACjE,MAAM,MAAM,KAAK,GACZ,MACG,iBAAiB,KAAK,oCAC1B,EACC,IAAI,OAAO,IAAI;AAAA,IACpB,OAAO,MAAM,YAAY,SAAS,GAAG,IAAI;AAAA;AAAA,OAGvC,KAAI,CAAC,OAAwC;AAAA,IAC/C,OAAO,KAAK,GACP,MAAqB,iBAAiB,KAAK,uBAAuB,EAClE,IAAI,KAAK,EACT,IAAI,YAAY,QAAQ;AAAA;AAAA,OAG3B,IAAG,CAAC,QAKgB;AAAA,IACtB,MAAM,MAAM,KAAK,IAAI;AAAA,IAErB,KAAK,GACA,MACG,eAAe,KAAK;AAAA;AAAA;AAAA;AAAA,gEAKxB,EACC,IACG,OAAO,OACP,OAAO,MACP,OAAO,QACP,KAAK,UAAU,OAAO,QAAQ,GAC9B,KACA,GACJ;AAAA,IAEJ,MAAM,SAAS,MAAM,KAAK,IAAI,OAAO,OAAO,OAAO,IAAI;AAAA,IACvD,IAAI,CAAC;AAAA,MAAQ,MAAM,IAAI,MAAM,mDAAmD;AAAA,IAChF,OAAO;AAAA;AAAA,OAGL,OAAM,CAAC,OAAe,MAAgC;AAAA,IACxD,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;AAAA,IAC3C,IAAI,CAAC;AAAA,MAAU,OAAO;AAAA,IACtB,KAAK,GACA,MAAM,eAAe,KAAK,oCAAoC,EAC9D,IAAI,OAAO,IAAI;AAAA,IACpB,OAAO;AAAA;AAAA,EAIX,KAAK,GAAS;AAAA,IACV,KAAK,GAAG,MAAM;AAAA;AAEtB;",
-  "debugId": "6FCBF9C9F6B3EDC164756E2164756E21",
+  "mappings": ";;AAAA;AAqBA,IAAM,gBAAoC;AAAA,EACtC,CAAC,cAAc,MAAM;AAAA,EACrB,CAAC,SAAS,MAAM;AAAA,EAChB,CAAC,aAAa,4BAA4B;AAAA,EAC1C,CAAC,YAAY,4BAA4B;AAAA,EACzC,CAAC,cAAc,SAAS;AAAA,EACxB,CAAC,WAAW,MAAM;AAAA,EAClB,CAAC,YAAY,MAAM;AAAA,EACnB,CAAC,cAAc,SAAS;AAAA,EACxB,CAAC,YAAY,MAAM;AACvB;AAAA;AAqCO,MAAM,YAAkC;AAAA,EAC1B;AAAA,EACA;AAAA,EAmCjB,WAAW,CAAC,WAA8B,YAAY,QAAQ,iBAAiB;AAAA,IAC3E,KAAK,KAAK,OAAO,aAAa,WAAW,IAAI,SAAS,QAAQ,IAAI;AAAA,IAClE,KAAK,QAAQ;AAAA,IACb,KAAK,GAAG,IACJ,8BAA8B,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQvC;AAAA,IAEA,MAAM,UAAU,IAAI,IAChB,KAAK,GACA,MAA4B,qBAAqB,KAAK,QAAQ,EAC9D,IAAI,EACJ,IAAI,CAAC,WAAW,OAAO,IAAI,CACpC;AAAA,IACA,YAAY,QAAQ,SAAS,eAAe;AAAA,MACxC,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG;AAAA,QACtB,KAAK,GAAG,IAAI,eAAe,KAAK,oBAAoB,UAAU,MAAM;AAAA,MACxE;AAAA,IACJ;AAAA;AAAA,SAaW,QAAQ,CAAC,KAAwB;AAAA,IAC5C,MAAM,UAA0B,IAAI,UAC7B,KAAK,MAAM,IAAI,OAAO,EAAwE,IAC3F,CAAC,WAAW,KAAK,OAAO,WAAW,IAAI,KAAK,MAAM,SAAS,EAAE,EACjE,IACA,CAAC;AAAA,IAEP,OAAO;AAAA,MACH,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,MACX,UAAU,IAAI,cAAc;AAAA,MAC5B,SAAS,IAAI,aAAa;AAAA,MAC1B,WAAW,IAAI,eAAe,OAAO,OAAO,IAAI,KAAK,IAAI,UAAU;AAAA,MACnE;AAAA,MACA,UAAU,IAAI,WACP,KAAK,MAAM,IAAI,QAAQ,IACxB;AAAA,MACN,WAAW,IAAI,eAAe,OAAO,OAAO,IAAI,KAAK,IAAI,UAAU;AAAA,MACnE,UAAU,IAAI,WAAY,KAAK,MAAM,IAAI,QAAQ,IAA+B,CAAC;AAAA,MACjF,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,MAClC,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,IACtC;AAAA;AAAA,OAcE,IAAG,CAAC,OAAe,MAA4C;AAAA,IACjE,MAAM,MAAM,KAAK,GACZ,MACG,iBAAiB,KAAK,oCAC1B,EACC,IAAI,OAAO,IAAI;AAAA,IACpB,OAAO,MAAM,YAAY,SAAS,GAAG,IAAI;AAAA;AAAA,OAUvC,KAAI,CAAC,OAAwC;AAAA,IAC/C,OAAO,KAAK,GACP,MAAqB,iBAAiB,KAAK,uBAAuB,EAClE,IAAI,KAAK,EACT,IAAI,YAAY,QAAQ;AAAA;AAAA,OAY3B,IAAG,GAA4B;AAAA,IACjC,OAAO,KAAK,GACP,MAAe,iBAAiB,KAAK,OAAO,EAC5C,IAAI,EACJ,IAAI,YAAY,QAAQ;AAAA;AAAA,OAkB3B,IAAG,CAAC,QAA6C;AAAA,IACnD,KAAK,GACA,MACG,eAAe,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qDAiBxB,EACC,IACG,OAAO,OACP,OAAO,MACP,OAAO,QACP,OAAO,WACP,OAAO,OACP,OAAO,WAAW,IAAI,GACtB,OAAO,UAAU,IAAI,GACrB,OAAO,WAAW,QAAQ,KAAK,MAC/B,KAAK,UAAU,OAAO,OAAO,GAC7B,OAAO,WAAW,KAAK,UAAU,OAAO,QAAQ,IAAI,MACpD,OAAO,WAAW,QAAQ,KAAK,MAC/B,KAAK,UAAU,OAAO,QAAQ,GAC9B,OAAO,UAAU,QAAQ,GACzB,OAAO,UAAU,QAAQ,CAC7B;AAAA,IAEJ,MAAM,SAAS,MAAM,KAAK,IAAI,OAAO,OAAO,OAAO,IAAI;AAAA,IACvD,IAAI,CAAC;AAAA,MAAQ,MAAM,IAAI,MAAM,mDAAmD;AAAA,IAChF,OAAO;AAAA;AAAA,OAcL,OAAM,CAAC,OAAe,MAAgC;AAAA,IACxD,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;AAAA,IAC3C,IAAI,CAAC;AAAA,MAAU,OAAO;AAAA,IACtB,KAAK,GAAG,MAAM,eAAe,KAAK,oCAAoC,EAAE,IAAI,OAAO,IAAI;AAAA,IACvF,OAAO;AAAA;AAAA,EAYX,KAAK,GAAS;AAAA,IACV,KAAK,GAAG,MAAM;AAAA;AAEtB;",
+  "debugId": "850E2DEC0A204F1364756E2164756E21",
   "names": []
 }