@penclipai/server 2026.704.0 → 2026.714.0

package/dist/services/secrets.d.ts

@@ -7,6 +7,7 @@ type SecretConsumerContext = {
     consumerType: SecretBindingTargetType;
     consumerId: string;
     configPath?: string | null;
+    responsibleUserId?: string | null;
     actorType?: "agent" | "user" | "system" | "plugin";
     actorId?: string | null;
     actorSource?: "local_implicit" | "session" | "board_key" | "agent_key" | "agent_jwt" | "cloud_tenant";
@@ -15,6 +16,10 @@ type SecretConsumerContext = {
     pluginId?: string | null;
     allowedBindingIds?: string[] | null;
 };
+type ResolveAdapterConfigForRuntimeOptions = {
+    adapterType?: string | null;
+    skipUserSecrets?: boolean;
+};
 export type RuntimeSecretManifestEntry = {
     configPath: string;
     envKey: string | null;
@@ -32,9 +37,20 @@ export type MissingRuntimeBinding = {
     consumerId: string;
     configPath: string;
     envKey: string;
-    secretId: string;
+    bindingType?: "secret_ref" | "user_secret_ref";
+    secretId: string | null;
     secretName: string | null;
+    userSecretDefinitionId?: string | null;
+    userSecretDefinitionKey?: string | null;
+    userSecretDefinitionName?: string | null;
+    responsibleUserId?: string | null;
+    errorCode?: SecretResolutionErrorCode;
 };
+type RuntimeSecretResolution = {
+    value: string;
+    manifestEntry: RuntimeSecretManifestEntry;
+};
+type SecretResolutionErrorCode = "binding_missing" | "secret_deleted" | "secret_inactive" | "secret_scope_invalid" | "responsible_user_missing" | "user_secret_definition_missing" | "user_secret_definition_inactive" | "user_secret_missing" | "version_missing" | "version_inactive" | "provider_error";
 export declare function secretService(db: Db): {
     listProviders: () => import("@penclipai/shared").SecretProviderDescriptor[];
     checkProviders: () => Promise<SecretProviderHealthCheck[]>;
@@ -645,16 +661,16 @@ export declare function secretService(db: Db): {
         userId?: string | null;
         agentId?: string | null;
     }) => Promise<{
-        id: string;
+        companyId: string;
         status: string;
-        createdAt: Date;
-        updatedAt: Date;
         config: Record<string, unknown>;
-        companyId: string;
-        provider: string;
+        id: string;
+        healthStatus: string | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        healthStatus: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: string;
         displayName: string;
         isDefault: boolean;
         healthCheckedAt: Date | null;
@@ -704,16 +720,16 @@ export declare function secretService(db: Db): {
         updatedAt: Date;
     } | null>;
     removeProviderConfig: (id: string) => Promise<{
-        id: string;
+        companyId: string;
         status: string;
-        createdAt: Date;
-        updatedAt: Date;
         config: Record<string, unknown>;
-        companyId: string;
-        provider: string;
+        id: string;
+        healthStatus: string | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        healthStatus: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: string;
         displayName: string;
         isDefault: boolean;
         healthCheckedAt: Date | null;
@@ -741,9 +757,9 @@ export declare function secretService(db: Db): {
     } | null>;
     checkProviderConfigHealth: (id: string) => Promise<{
         checkedAt: Date;
+        message: string;
         status: SecretProviderConfigHealthStatus;
         provider: SecretProvider;
-        message: string;
         details: import("@penclipai/shared").SecretProviderConfigHealthDetails;
         configId: string;
     } | null>;
@@ -751,6 +767,9 @@ export declare function secretService(db: Db): {
         referenceCount: number;
         id: string;
         companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
         key: string;
         name: string;
         provider: string;
@@ -1214,7 +1233,24 @@ export declare function secretService(db: Db): {
             columnType: "PgUUID";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userSecretDefinitionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_secret_definition_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1224,6 +1260,23 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        secretScope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_scope";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         version: import("drizzle-orm/pg-core").PgColumn<{
             name: "version";
             tableName: "secret_access_events";
@@ -1258,6 +1311,74 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        responsibleUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "responsible_user_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialOwnerUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_owner_user_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialSubjectType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_subject_type";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialSubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_subject_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         actorType: import("drizzle-orm/pg-core").PgColumn<{
             name: "actor_type";
             tableName: "secret_access_events";
@@ -1448,9 +1569,15 @@ export declare function secretService(db: Db): {
     }, "single", Record<"secret_access_events", "not-null">, false, "where" | "orderBy", {
         id: string;
         companyId: string;
-        secretId: string;
+        secretId: string | null;
+        userSecretDefinitionId: string | null;
+        secretScope: string;
         version: number | null;
         provider: string;
+        responsibleUserId: string | null;
+        credentialOwnerUserId: string | null;
+        credentialSubjectType: string | null;
+        credentialSubjectId: string | null;
         actorType: string;
         actorId: string | null;
         consumerType: string;
@@ -1504,7 +1631,24 @@ export declare function secretService(db: Db): {
             columnType: "PgUUID";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userSecretDefinitionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_secret_definition_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1514,6 +1658,23 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        secretScope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_scope";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         version: import("drizzle-orm/pg-core").PgColumn<{
             name: "version";
             tableName: "secret_access_events";
@@ -1548,6 +1709,74 @@ export declare function secretService(db: Db): {
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        responsibleUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "responsible_user_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialOwnerUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_owner_user_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialSubjectType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_subject_type";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialSubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_subject_id";
+            tableName: "secret_access_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         actorType: import("drizzle-orm/pg-core").PgColumn<{
             name: "actor_type";
             tableName: "secret_access_events";
@@ -1736,48 +1965,1003 @@ export declare function secretService(db: Db): {
             generated: undefined;
         }, {}, {}>;
     }>, "where" | "orderBy">;
-    previewRemoteImport: (companyId: string, input: {
-        providerConfigId: string;
-        query?: string | null;
-        nextToken?: string | null;
-        pageSize?: number;
-    }) => Promise<{
-        providerConfigId: string;
-        provider: "local_encrypted" | "aws_secrets_manager" | "gcp_secret_manager" | "vault";
-        nextToken: string | null;
-        candidates: RemoteSecretImportCandidate[];
-    }>;
-    importRemoteSecrets: (companyId: string, input: {
-        providerConfigId: string;
-        secrets: Array<{
-            externalRef: string;
-            name?: string | null;
-            key?: string | null;
-            description?: string | null;
-            providerVersionRef?: string | null;
-            providerMetadata?: Record<string, unknown> | null;
-        }>;
-    }, actor?: {
-        userId?: string | null;
-        agentId?: string | null;
-    }) => Promise<{
-        providerConfigId: string;
-        provider: "local_encrypted" | "aws_secrets_manager" | "gcp_secret_manager" | "vault";
-        importedCount: number;
-        skippedCount: number;
-        errorCount: number;
-        results: RemoteSecretImportRowResult[];
-    }>;
-    getById: (id: string, source?: Pick<Db | DbTransaction, "select">) => Promise<{
-        id: string;
-        companyId: string;
-        key: string;
-        name: string;
-        provider: string;
-        status: string;
-        managedMode: string;
-        externalRef: string | null;
-        providerConfigId: string | null;
+    listUserSecretDefinitions: (companyId: string) => Omit<import("drizzle-orm/pg-core").PgSelectBase<"user_secret_definitions", {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        companyId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        description: import("drizzle-orm/pg-core").PgColumn<{
+            name: "description";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        managedMode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "managed_mode";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerConfigId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_config_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerMetadata: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_metadata";
+            tableName: "user_secret_definitions";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        usageGuidance: import("drizzle-orm/pg-core").PgColumn<{
+            name: "usage_guidance";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByAgentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_agent_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_user_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedByAgentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_by_agent_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedByUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_by_user_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deleted_at";
+            tableName: "user_secret_definitions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "user_secret_definitions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "user_secret_definitions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    }, "single", Record<"user_secret_definitions", "not-null">, false, "where" | "orderBy", {
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        description: string | null;
+        status: string;
+        provider: string;
+        managedMode: string;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        usageGuidance: string | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        updatedByAgentId: string | null;
+        updatedByUserId: string | null;
+        deletedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }[], {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        companyId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        description: import("drizzle-orm/pg-core").PgColumn<{
+            name: "description";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        managedMode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "managed_mode";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerConfigId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_config_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerMetadata: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_metadata";
+            tableName: "user_secret_definitions";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        usageGuidance: import("drizzle-orm/pg-core").PgColumn<{
+            name: "usage_guidance";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByAgentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_agent_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_user_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedByAgentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_by_agent_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedByUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_by_user_id";
+            tableName: "user_secret_definitions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deleted_at";
+            tableName: "user_secret_definitions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "user_secret_definitions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "user_secret_definitions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    }>, "where" | "orderBy">;
+    getUserSecretDefinitionById: (companyId: string, definitionId: string) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        description: string | null;
+        status: string;
+        provider: string;
+        managedMode: string;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        usageGuidance: string | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        updatedByAgentId: string | null;
+        updatedByUserId: string | null;
+        deletedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    createUserSecretDefinition: (companyId: string, input: {
+        key: string;
+        name: string;
+        description?: string | null;
+        status?: string;
+        provider: SecretProvider;
+        providerConfigId?: string | null;
+        managedMode?: "paperclip_managed" | "external_reference";
+        providerMetadata?: Record<string, unknown> | null;
+        usageGuidance?: string | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        description: string | null;
+        companyId: string;
+        status: string;
+        id: string;
+        key: string;
+        name: string;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        updatedByAgentId: string | null;
+        updatedByUserId: string | null;
+        provider: string;
+        providerConfigId: string | null;
+        managedMode: string;
+        providerMetadata: Record<string, unknown> | null;
+        usageGuidance: string | null;
+        deletedAt: Date | null;
+    }>;
+    updateUserSecretDefinition: (companyId: string, definitionId: string, patch: {
+        key?: string;
+        name?: string;
+        description?: string | null;
+        status?: string;
+        providerConfigId?: string | null;
+        providerMetadata?: Record<string, unknown> | null;
+        usageGuidance?: string | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        description: string | null;
+        status: string;
+        provider: string;
+        managedMode: string;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        usageGuidance: string | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        updatedByAgentId: string | null;
+        updatedByUserId: string | null;
+        deletedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    removeUserSecretDefinition: (companyId: string, definitionId: string, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        key: string;
+        name: string;
+        description: string | null;
+        status: string;
+        provider: string;
+        managedMode: string;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        usageGuidance: string | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        updatedByAgentId: string | null;
+        updatedByUserId: string | null;
+        deletedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    getUserSecretDefinitionCoverage: (companyId: string, definitionId: string) => Promise<{
+        definitionId: string;
+        configuredCount: number;
+        inactiveCount: number;
+        missingCount: number;
+    }>;
+    listCurrentUserSecretValues: (companyId: string, ownerUserId: string) => Promise<{
+        definition: {
+            id: string;
+            companyId: string;
+            key: string;
+            name: string;
+            description: string | null;
+            status: string;
+            provider: string;
+            managedMode: string;
+            providerConfigId: string | null;
+            providerMetadata: Record<string, unknown> | null;
+            usageGuidance: string | null;
+            createdByAgentId: string | null;
+            createdByUserId: string | null;
+            updatedByAgentId: string | null;
+            updatedByUserId: string | null;
+            deletedAt: Date | null;
+            createdAt: Date;
+            updatedAt: Date;
+        };
+        secret: {
+            id: string;
+            companyId: string;
+            scope: string;
+            ownerUserId: string | null;
+            userSecretDefinitionId: string | null;
+            key: string;
+            name: string;
+            provider: string;
+            status: string;
+            managedMode: string;
+            externalRef: string | null;
+            providerConfigId: string | null;
+            providerMetadata: Record<string, unknown> | null;
+            latestVersion: number;
+            description: string | null;
+            lastResolvedAt: Date | null;
+            lastRotatedAt: Date | null;
+            deletedAt: Date | null;
+            createdByAgentId: string | null;
+            createdByUserId: string | null;
+            createdAt: Date;
+            updatedAt: Date;
+        } | null;
+    }[]>;
+    createCurrentUserSecretValue: (companyId: string, ownerUserId: string, input: {
+        definitionId?: string | null;
+        definitionKey?: string | null;
+        value?: string | null;
+        externalRef?: string | null;
+        providerVersionRef?: string | null;
+        providerConfigId?: string | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    rotateCurrentUserSecretValue: (companyId: string, ownerUserId: string, secretId: string, input: {
+        value?: string | null;
+        externalRef?: string | null;
+        providerVersionRef?: string | null;
+        providerConfigId?: string | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    updateCurrentUserSecretValue: (companyId: string, ownerUserId: string, secretId: string, patch: {
+        status?: "active" | "disabled" | "archived" | "deleted";
+        value?: string | null;
+        externalRef?: string | null;
+        providerVersionRef?: string | null;
+        providerConfigId?: string | null;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        id: string;
+        companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    } | null>;
+    removeCurrentUserSecretValue: (companyId: string, ownerUserId: string, secretId: string) => Promise<{
+        id: string;
+        companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
+        providerMetadata: Record<string, unknown> | null;
+        latestVersion: number;
+        description: string | null;
+        lastResolvedAt: Date | null;
+        lastRotatedAt: Date | null;
+        deletedAt: Date | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    } | null>;
+    syncUserSecretDeclarationsForTarget: (companyId: string, target: {
+        targetType: SecretBindingTargetType;
+        targetId: string;
+        pathPrefix?: string;
+    }, refs: Array<{
+        definitionKey: string;
+        configPath: string;
+        envKey: string;
+        versionSelector?: SecretVersionSelector;
+        required?: boolean;
+        allowMissingOverride?: boolean;
+        label?: string | null;
+    }>, options?: {
+        db?: SecretBindingDb;
+        replaceAll?: boolean;
+    }) => Promise<{
+        definitionId: string;
+        configPath: string;
+        envKey: string;
+        versionSelector: SecretVersionSelector;
+        required: boolean;
+        allowMissingOverride: boolean;
+        label: string | null;
+    }[]>;
+    resolveUserSecretValue: (companyId: string, input: {
+        definitionKey?: string | null;
+        definitionId?: string | null;
+        responsibleUserId?: string | null;
+        version?: SecretVersionSelector;
+        required?: boolean;
+        allowMissingOverride?: boolean;
+    }, context?: SecretConsumerContext) => Promise<RuntimeSecretResolution | null>;
+    previewRemoteImport: (companyId: string, input: {
+        providerConfigId: string;
+        query?: string | null;
+        nextToken?: string | null;
+        pageSize?: number;
+    }) => Promise<{
+        providerConfigId: string;
+        provider: "local_encrypted" | "aws_secrets_manager" | "gcp_secret_manager" | "vault";
+        nextToken: string | null;
+        candidates: RemoteSecretImportCandidate[];
+    }>;
+    importRemoteSecrets: (companyId: string, input: {
+        providerConfigId: string;
+        secrets: Array<{
+            externalRef: string;
+            name?: string | null;
+            key?: string | null;
+            description?: string | null;
+            providerVersionRef?: string | null;
+            providerMetadata?: Record<string, unknown> | null;
+        }>;
+    }, actor?: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<{
+        providerConfigId: string;
+        provider: "local_encrypted" | "aws_secrets_manager" | "gcp_secret_manager" | "vault";
+        importedCount: number;
+        skippedCount: number;
+        errorCount: number;
+        results: RemoteSecretImportRowResult[];
+    }>;
+    getById: (id: string, source?: Pick<Db | DbTransaction, "select">) => Promise<{
+        id: string;
+        companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
+        key: string;
+        name: string;
+        provider: string;
+        status: string;
+        managedMode: string;
+        externalRef: string | null;
+        providerConfigId: string | null;
         providerMetadata: Record<string, unknown> | null;
         latestVersion: number;
         description: string | null;
@@ -1792,6 +2976,9 @@ export declare function secretService(db: Db): {
     getByName: (companyId: string, name: string) => Promise<{
         id: string;
         companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
         key: string;
         name: string;
         provider: string;
@@ -1829,6 +3016,9 @@ export declare function secretService(db: Db): {
     }) => Promise<{
         id: string;
         companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
         key: string;
         name: string;
         provider: string;
@@ -1858,6 +3048,9 @@ export declare function secretService(db: Db): {
     }) => Promise<{
         id: string;
         companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
         key: string;
         name: string;
         provider: string;
@@ -1887,6 +3080,9 @@ export declare function secretService(db: Db): {
     }) => Promise<{
         id: string;
         companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
         key: string;
         name: string;
         provider: string;
@@ -1915,11 +3111,11 @@ export declare function secretService(db: Db): {
         required?: boolean;
         label?: string | null;
     }) => Promise<{
+        companyId: string;
         id: string;
+        required: boolean;
         createdAt: Date;
         updatedAt: Date;
-        companyId: string;
-        required: boolean;
         label: string | null;
         secretId: string;
         targetType: string;
@@ -1963,6 +3159,9 @@ export declare function secretService(db: Db): {
     remove: (secretId: string) => Promise<{
         id: string;
         companyId: string;
+        scope: string;
+        ownerUserId: string | null;
+        userSecretDefinitionId: string | null;
         key: string;
         name: string;
         provider: string;
@@ -2012,9 +3211,7 @@ export declare function secretService(db: Db): {
     }>;
     collectMissingRuntimeBindings: (companyId: string, envValue: unknown, context: Omit<SecretConsumerContext, "configPath">) => Promise<MissingRuntimeBinding[]>;
     collectMissingAdapterConfigRuntimeBindings: (companyId: string, adapterConfig: Record<string, unknown>, adapterType: string | null | undefined, context: Omit<SecretConsumerContext, "configPath">) => Promise<MissingRuntimeBinding[]>;
-    resolveAdapterConfigForRuntime: (companyId: string, adapterConfig: Record<string, unknown>, context?: Omit<SecretConsumerContext, "configPath">, opts?: {
-        adapterType?: string | null;
-    }) => Promise<{
+    resolveAdapterConfigForRuntime: (companyId: string, adapterConfig: Record<string, unknown>, context?: Omit<SecretConsumerContext, "configPath">, opts?: ResolveAdapterConfigForRuntimeOptions) => Promise<{
         config: Record<string, unknown>;
         secretKeys: Set<string>;
         manifest: RuntimeSecretManifestEntry[];