@penclipai/server 2026.508.2 → 2026.511.0-canary.0

package/dist/services/secrets.d.ts

@@ -1,11 +1,33 @@
 import type { Db } from "@penclipai/db";
-import type { AgentEnvConfig, SecretProvider } from "@penclipai/shared";
+import type { AgentEnvConfig, CompanySecretBindingTarget, RemoteSecretImportCandidate, RemoteSecretImportRowResult, SecretBindingTargetType, SecretProvider, SecretProviderConfigHealthStatus, SecretProviderConfigStatus, SecretVersionSelector } from "@penclipai/shared";
+import type { SecretProviderHealthCheck } from "../secrets/types.js";
+type SecretConsumerContext = {
+    consumerType: SecretBindingTargetType;
+    consumerId: string;
+    configPath?: string | null;
+    actorType?: "agent" | "user" | "system" | "plugin";
+    actorId?: string | null;
+    issueId?: string | null;
+    heartbeatRunId?: string | null;
+    pluginId?: string | null;
+};
+export type RuntimeSecretManifestEntry = {
+    configPath: string;
+    envKey: string | null;
+    secretId: string;
+    secretKey: string;
+    version: number;
+    provider: SecretProvider;
+    outcome: "success" | "failure";
+    errorCode?: string | null;
+};
 export declare function secretService(db: Db): {
     listProviders: () => import("@penclipai/shared").SecretProviderDescriptor[];
-    list: (companyId: string) => Omit<import("drizzle-orm/pg-core").PgSelectBase<"company_secrets", {
+    checkProviders: () => Promise<SecretProviderHealthCheck[]>;
+    listProviderConfigs: (companyId: string) => Omit<import("drizzle-orm/pg-core").PgSelectBase<"company_secret_provider_configs", {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgUUID";
             data: string;
@@ -22,7 +44,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         companyId: import("drizzle-orm/pg-core").PgColumn<{
             name: "company_id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgUUID";
             data: string;
@@ -37,9 +59,9 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "company_secrets";
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -54,9 +76,26 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        provider: import("drizzle-orm/pg-core").PgColumn<{
-            name: "provider";
-            tableName: "company_secrets";
+        displayName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "display_name";
+            tableName: "company_secret_provider_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -71,9 +110,45 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        externalRef: import("drizzle-orm/pg-core").PgColumn<{
-            name: "external_ref";
-            tableName: "company_secrets";
+        isDefault: import("drizzle-orm/pg-core").PgColumn<{
+            name: "is_default";
+            tableName: "company_secret_provider_configs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        config: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config";
+            tableName: "company_secret_provider_configs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        healthStatus: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_status";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -88,15 +163,15 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        latestVersion: import("drizzle-orm/pg-core").PgColumn<{
-            name: "latest_version";
-            tableName: "company_secrets";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: true;
+        healthCheckedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_checked_at";
+            tableName: "company_secret_provider_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -105,9 +180,9 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        description: import("drizzle-orm/pg-core").PgColumn<{
-            name: "description";
-            tableName: "company_secrets";
+        healthMessage: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_message";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -122,9 +197,45 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        healthDetails: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_details";
+            tableName: "company_secret_provider_configs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        disabledAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "disabled_at";
+            tableName: "company_secret_provider_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdByAgentId: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_by_agent_id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgUUID";
             data: string;
@@ -141,7 +252,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         createdByUserId: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_by_user_id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -158,7 +269,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;
@@ -175,7 +286,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         updatedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "updated_at";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;
@@ -190,22 +301,27 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    }, "single", Record<"company_secrets", "not-null">, false, "where" | "orderBy", {
+    }, "single", Record<"company_secret_provider_configs", "not-null">, false, "where" | "orderBy", {
         id: string;
-        name: string;
-        description: string | null;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         provider: string;
+        displayName: string;
+        status: string;
+        isDefault: boolean;
+        config: Record<string, unknown>;
+        healthStatus: string | null;
+        healthCheckedAt: Date | null;
+        healthMessage: string | null;
+        healthDetails: Record<string, unknown> | null;
+        disabledAt: Date | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        externalRef: string | null;
-        latestVersion: number;
+        createdAt: Date;
+        updatedAt: Date;
     }[], {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgUUID";
             data: string;
@@ -222,7 +338,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         companyId: import("drizzle-orm/pg-core").PgColumn<{
             name: "company_id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgUUID";
             data: string;
@@ -237,9 +353,9 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "company_secrets";
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -254,9 +370,26 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        provider: import("drizzle-orm/pg-core").PgColumn<{
-            name: "provider";
-            tableName: "company_secrets";
+        displayName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "display_name";
+            tableName: "company_secret_provider_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -271,9 +404,45 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        externalRef: import("drizzle-orm/pg-core").PgColumn<{
-            name: "external_ref";
-            tableName: "company_secrets";
+        isDefault: import("drizzle-orm/pg-core").PgColumn<{
+            name: "is_default";
+            tableName: "company_secret_provider_configs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        config: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config";
+            tableName: "company_secret_provider_configs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        healthStatus: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_status";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -288,15 +457,15 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        latestVersion: import("drizzle-orm/pg-core").PgColumn<{
-            name: "latest_version";
-            tableName: "company_secrets";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: true;
+        healthCheckedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_checked_at";
+            tableName: "company_secret_provider_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -305,9 +474,9 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        description: import("drizzle-orm/pg-core").PgColumn<{
-            name: "description";
-            tableName: "company_secrets";
+        healthMessage: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_message";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -322,9 +491,45 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        healthDetails: import("drizzle-orm/pg-core").PgColumn<{
+            name: "health_details";
+            tableName: "company_secret_provider_configs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        disabledAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "disabled_at";
+            tableName: "company_secret_provider_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdByAgentId: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_by_agent_id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgUUID";
             data: string;
@@ -341,7 +546,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         createdByUserId: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_by_user_id";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -358,7 +563,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;
@@ -375,7 +580,7 @@ export declare function secretService(db: Db): {
         }, {}, {}>;
         updatedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "updated_at";
-            tableName: "company_secrets";
+            tableName: "company_secret_provider_configs";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;
@@ -391,103 +596,1342 @@ export declare function secretService(db: Db): {
             generated: undefined;
         }, {}, {}>;
     }>, "where" | "orderBy">;
-    getById: (id: string) => Promise<{
+    getProviderConfigById: (id: string) => Promise<{
         id: string;
-        name: string;
-        description: string | null;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         provider: string;
+        displayName: string;
+        status: string;
+        isDefault: boolean;
+        config: Record<string, unknown>;
+        healthStatus: string | null;
+        healthCheckedAt: Date | null;
+        healthMessage: string | null;
+        healthDetails: Record<string, unknown> | null;
+        disabledAt: Date | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        externalRef: string | null;
-        latestVersion: number;
-    }>;
-    getByName: (companyId: string, name: string) => Promise<{
-        id: string;
-        name: string;
-        description: string | null;
         createdAt: Date;
         updatedAt: Date;
-        companyId: string;
-        provider: string;
-        createdByAgentId: string | null;
-        createdByUserId: string | null;
-        externalRef: string | null;
-        latestVersion: number;
     }>;
-    resolveSecretValue: (companyId: string, secretId: string, version: number | "latest") => Promise<string>;
-    create: (companyId: string, input: {
-        name: string;
+    createProviderConfig: (companyId: string, input: {
         provider: SecretProvider;
-        value: string;
-        description?: string | null;
-        externalRef?: string | null;
+        displayName: string;
+        status?: SecretProviderConfigStatus;
+        isDefault?: boolean;
+        config?: Record<string, unknown>;
     }, actor?: {
         userId?: string | null;
         agentId?: string | null;
     }) => Promise<{
         id: string;
-        name: string;
-        description: string | null;
+        status: string;
         createdAt: Date;
         updatedAt: Date;
         companyId: string;
+        config: Record<string, unknown>;
         provider: string;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        externalRef: string | null;
-        latestVersion: number;
+        healthStatus: string | null;
+        displayName: string;
+        isDefault: boolean;
+        healthCheckedAt: Date | null;
+        healthMessage: string | null;
+        healthDetails: Record<string, unknown> | null;
+        disabledAt: Date | null;
     }>;
-    rotate: (secretId: string, input: {
-        value: string;
-        externalRef?: string | null;
-    }, actor?: {
-        userId?: string | null;
-        agentId?: string | null;
+    updateProviderConfig: (id: string, patch: {
+        displayName?: string;
+        status?: SecretProviderConfigStatus;
+        isDefault?: boolean;
+        config?: Record<string, unknown>;
     }) => Promise<{
         id: string;
         companyId: string;
-        name: string;
         provider: string;
-        externalRef: string | null;
-        latestVersion: number;
-        description: string | null;
+        displayName: string;
+        status: string;
+        isDefault: boolean;
+        config: Record<string, unknown>;
+        healthStatus: string | null;
+        healthCheckedAt: Date | null;
+        healthMessage: string | null;
+        healthDetails: Record<string, unknown> | null;
+        disabledAt: Date | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
         createdAt: Date;
         updatedAt: Date;
-    }>;
-    update: (secretId: string, patch: {
-        name?: string;
-        description?: string | null;
-        externalRef?: string | null;
-    }) => Promise<{
+    } | null>;
+    disableProviderConfig: (id: string) => Promise<{
         id: string;
         companyId: string;
-        name: string;
         provider: string;
-        externalRef: string | null;
-        latestVersion: number;
-        description: string | null;
+        displayName: string;
+        status: string;
+        isDefault: boolean;
+        config: Record<string, unknown>;
+        healthStatus: string | null;
+        healthCheckedAt: Date | null;
+        healthMessage: string | null;
+        healthDetails: Record<string, unknown> | null;
+        disabledAt: Date | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
         createdAt: Date;
         updatedAt: Date;
-    }>;
-    remove: (secretId: string) => Promise<{
+    } | null>;
+    setDefaultProviderConfig: (id: string) => Promise<{
         id: string;
-        name: string;
-        description: string | null;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         provider: string;
+        displayName: string;
+        status: string;
+        isDefault: boolean;
+        config: Record<string, unknown>;
+        healthStatus: string | null;
+        healthCheckedAt: Date | null;
+        healthMessage: string | null;
+        healthDetails: Record<string, unknown> | null;
+        disabledAt: Date | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    } | null>;
+    checkProviderConfigHealth: (id: string) => Promise<{
+        checkedAt: Date;
+        status: SecretProviderConfigHealthStatus;
+        provider: SecretProvider;
+        message: string;
+        details: import("@penclipai/shared").SecretProviderConfigHealthDetails;
+        configId: string;
+    } | null>;
+    list: (companyId: string) => Promise<{
+        referenceCount: number;
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
         externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
         latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }[]>;
+    listBindings: (companyId: string, secretId?: string) => Omit<import("drizzle-orm/pg-core").PgSelectBase<"company_secret_bindings", {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        companyId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company_id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        targetType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_type";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        targetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        configPath: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config_path";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        versionSelector: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version_selector";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        required: import("drizzle-orm/pg-core").PgColumn<{
+            name: "required";
+            tableName: "company_secret_bindings";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        label: import("drizzle-orm/pg-core").PgColumn<{
+            name: "label";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "company_secret_bindings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "company_secret_bindings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    }, "single", Record<"company_secret_bindings", "not-null">, false, "where" | "orderBy", {
+        id: string;
+        companyId: string;
+        secretId: string;
+        targetType: string;
+        targetId: string;
+        configPath: string;
+        versionSelector: string;
+        required: boolean;
+        label: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }[], {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        companyId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company_id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        targetType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_type";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        targetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_id";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        configPath: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config_path";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        versionSelector: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version_selector";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        required: import("drizzle-orm/pg-core").PgColumn<{
+            name: "required";
+            tableName: "company_secret_bindings";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        label: import("drizzle-orm/pg-core").PgColumn<{
+            name: "label";
+            tableName: "company_secret_bindings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "company_secret_bindings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "company_secret_bindings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    }>, "where" | "orderBy">;
+    listBindingReferences: (companyId: string, secretId: string) => Promise<{
+        target: CompanySecretBindingTarget;
+        id: string;
+        companyId: string;
+        secretId: string;
+        targetType: string;
+        targetId: string;
+        configPath: string;
+        versionSelector: string;
+        required: boolean;
+        label: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }[]>;
+    listAccessEvents: (companyId: string, secretId: string) => Omit<import("drizzle-orm/pg-core").PgSelectBase<"secret_access_events", {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        companyId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        version: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version";
+            tableName: "secret_access_events";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_type";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumerType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumer_type";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumer_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        configPath: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config_path";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        issueId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "issue_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        heartbeatRunId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "heartbeat_run_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pluginId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "plugin_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        outcome: import("drizzle-orm/pg-core").PgColumn<{
+            name: "outcome";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        errorCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "error_code";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "secret_access_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    }, "single", Record<"secret_access_events", "not-null">, false, "where" | "orderBy", {
+        id: string;
+        companyId: string;
+        secretId: string;
+        version: number | null;
+        provider: string;
+        actorType: string;
+        actorId: string | null;
+        consumerType: string;
+        consumerId: string;
+        configPath: string | null;
+        issueId: string | null;
+        heartbeatRunId: string | null;
+        pluginId: string | null;
+        outcome: string;
+        errorCode: string | null;
+        createdAt: Date;
+    }[], {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        companyId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        version: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version";
+            tableName: "secret_access_events";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_type";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumerType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumer_type";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumer_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        configPath: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config_path";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        issueId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "issue_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        heartbeatRunId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "heartbeat_run_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pluginId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "plugin_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        outcome: import("drizzle-orm/pg-core").PgColumn<{
+            name: "outcome";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        errorCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "error_code";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "secret_access_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    }>, "where" | "orderBy">;
+    previewRemoteImport: (companyId: string, input: {
+        providerConfigId: string;
+        query?: string | null;
+        nextToken?: string | null;
+        pageSize?: number;
+    }) => Promise<{
+        providerConfigId: string;
+        provider: "local_encrypted" | "aws_secrets_manager" | "gcp_secret_manager" | "vault";
+        nextToken: string | null;
+        candidates: RemoteSecretImportCandidate[];
+    }>;
+    importRemoteSecrets: (companyId: string, input: {
+        providerConfigId: string;
+        secrets: Array<{
+            externalRef: string;
+            name?: string | null;
+            key?: string | null;
+            description?: string | null;
+            providerVersionRef?: string | null;
+            providerMetadata?: Record<string, unknown> | null;
+        }>;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        providerConfigId: string;
+        provider: "local_encrypted" | "aws_secrets_manager" | "gcp_secret_manager" | "vault";
+        importedCount: number;
+        skippedCount: number;
+        errorCount: number;
+        results: RemoteSecretImportRowResult[];
+    }>;
+    getById: (id: string) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    getByName: (companyId: string, name: string) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    resolveSecretValue: (companyId: string, secretId: string, version: number | "latest", context?: SecretConsumerContext) => Promise<string>;
+    create: (companyId: string, input: {
+        name: string;
+        provider: SecretProvider;
+        providerConfigId?: string | null;
+        value?: string | null;
+        key?: string | null;
+        managedMode?: "paperclip_managed" | "external_reference";
+        description?: string | null;
+        externalRef?: string | null;
+        providerVersionRef?: string | null;
+        providerMetadata?: Record<string, unknown> | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    rotate: (secretId: string, input: {
+        value?: string | null;
+        externalRef?: string | null;
+        providerVersionRef?: string | null;
+        providerConfigId?: string | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    update: (secretId: string, patch: {
+        name?: string;
+        key?: string;
+        status?: "active" | "disabled" | "archived" | "deleted";
+        providerConfigId?: string | null;
+        description?: string | null;
+        externalRef?: string | null;
+        providerMetadata?: Record<string, unknown> | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    createBinding: (input: {
+        companyId: string;
+        secretId: string;
+        targetType: SecretBindingTargetType;
+        targetId: string;
+        configPath: string;
+        versionSelector?: SecretVersionSelector;
+        required?: boolean;
+        label?: string | null;
+    }) => Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        required: boolean;
+        label: string | null;
+        secretId: string;
+        targetType: string;
+        targetId: string;
+        configPath: string;
+        versionSelector: string;
+    }>;
+    syncSecretRefsForTarget: (companyId: string, target: {
+        targetType: SecretBindingTargetType;
+        targetId: string;
+    }, refs: Array<{
+        secretId: string;
+        configPath: string;
+        versionSelector?: SecretVersionSelector;
+        required?: boolean;
+        label?: string | null;
+    }>) => Promise<{
+        secretId: string;
+        configPath: string;
+        versionSelector: SecretVersionSelector;
+        required: boolean;
+        label: string | null;
+    }[]>;
+    syncEnvBindingsForTarget: (companyId: string, target: {
+        targetType: SecretBindingTargetType;
+        targetId: string;
+        pathPrefix?: string;
+    }, envValue: unknown) => Promise<{
+        secretId: string;
+        configPath: string;
+        versionSelector: SecretVersionSelector;
+    }[]>;
+    remove: (secretId: string) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     } | null>;
     normalizeAdapterConfigForPersistence: (companyId: string, adapterConfig: Record<string, unknown>, opts?: {
         strictMode?: boolean;
@@ -503,13 +1947,16 @@ export declare function secretService(db: Db): {
     }) => Promise<{
         [x: string]: unknown;
     }>;
-    resolveEnvBindings: (companyId: string, envValue: unknown) => Promise<{
+    resolveEnvBindings: (companyId: string, envValue: unknown, context?: Omit<SecretConsumerContext, "configPath">) => Promise<{
         env: Record<string, string>;
         secretKeys: Set<string>;
+        manifest: RuntimeSecretManifestEntry[];
     }>;
-    resolveAdapterConfigForRuntime: (companyId: string, adapterConfig: Record<string, unknown>) => Promise<{
+    resolveAdapterConfigForRuntime: (companyId: string, adapterConfig: Record<string, unknown>, context?: Omit<SecretConsumerContext, "configPath">) => Promise<{
         config: Record<string, unknown>;
         secretKeys: Set<string>;
+        manifest: RuntimeSecretManifestEntry[];
     }>;
 };
+export {};
 //# sourceMappingURL=secrets.d.ts.map