@shipfox/api-secrets 2.0.0

package/dist/core/management.js

@@ -0,0 +1,403 @@
+import { SECRET_CREATED, SECRET_DELETED, SECRET_UPDATED, VARIABLE_CREATED, VARIABLE_DELETED, VARIABLE_UPDATED } from '@shipfox/api-secrets-dto';
+import { writeOutboxEvent } from '@shipfox/node-outbox';
+import { db, deleteSecretManagementRows, deleteVariableManagementRows, getSecretManagementRow, getVariableManagementRow, listExistingSecretManagementKeys, listExistingVariableManagementKeys, listSecretManagementRows, listVariableManagementRows, lockWorkspaceEntries, secretsOutbox, upsertSecretValueRows, upsertSecretVariableRows } from '#db/index.js';
+import { normalizedProjectId } from '#db/scope.js';
+import { classifySecretsOperationError, operationScope, recordSecretsEntriesMutated, recordSecretsOperation } from '#metrics/instance.js';
+import { SecretBatchDuplicateKeyError, SecretNotFoundError, VariableNotFoundError } from './errors.js';
+import { fingerprintSecretValue } from './fingerprint.js';
+import { assertWorkspaceCap, validateSecretKeys, validateValueBytes } from './store-validation.js';
+import { encryptSecretValue } from './value-cipher.js';
+export function createSecretsManagementApi(params) {
+    return {
+        async listSecrets (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const result = await listSecretManagementRows(input);
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'list',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return result;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'list',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async listVariables (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const result = await listVariableManagementRows(input);
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'list',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return result;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'list',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async getVariable (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                validateSecretKeys([
+                    input.key
+                ]);
+                const variable = await getVariableManagementRow(input);
+                if (!variable) throw new VariableNotFoundError(input.key);
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'get',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return variable;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'get',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async setSecrets (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const entries = normalizeEntries(input.entries);
+                validateSecretKeys(entries.map((entry)=>entry.key));
+                validateValueBytes(entries.map((entry)=>entry.value));
+                if (entries.length === 0) {
+                    recordSecretsOperation({
+                        resource: 'secret',
+                        operation: 'set',
+                        surface: 'management',
+                        scope,
+                        outcome: 'success',
+                        durationMs: Date.now() - startedAt
+                    });
+                    return [];
+                }
+                const projectId = normalizedProjectId(input);
+                const dek = await params.dekManager.getPlaintextDek(input.workspaceId);
+                const rows = await writeManagementEntries({
+                    resource: 'secret',
+                    input,
+                    keys: entries.map((entry)=>entry.key),
+                    listExistingKeys: listExistingSecretManagementKeys,
+                    writeRows: async (tx)=>{
+                        await upsertSecretValueRows(entries.map((entry)=>({
+                                workspaceId: input.workspaceId,
+                                projectId,
+                                namespace: '',
+                                key: entry.key,
+                                ciphertext: encryptSecretValue({
+                                    dek,
+                                    workspaceId: input.workspaceId,
+                                    scope: {
+                                        projectId
+                                    },
+                                    namespace: '',
+                                    key: entry.key,
+                                    value: entry.value
+                                }),
+                                fingerprint: fingerprintSecretValue(entry.value, dek),
+                                lastEditedBy: input.actorId
+                            })), tx);
+                        const rows = await Promise.all(entries.map((entry)=>getSecretManagementRow({
+                                workspaceId: input.workspaceId,
+                                projectId,
+                                key: entry.key
+                            }, tx)));
+                        return rows.map(assertFound);
+                    },
+                    eventTypes: {
+                        created: SECRET_CREATED,
+                        updated: SECRET_UPDATED
+                    }
+                });
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'set',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return rows;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'set',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async setVariables (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const entries = normalizeEntries(input.entries);
+                validateSecretKeys(entries.map((entry)=>entry.key));
+                validateValueBytes(entries.map((entry)=>entry.value));
+                if (entries.length === 0) {
+                    recordSecretsOperation({
+                        resource: 'variable',
+                        operation: 'set',
+                        surface: 'management',
+                        scope,
+                        outcome: 'success',
+                        durationMs: Date.now() - startedAt
+                    });
+                    return [];
+                }
+                const projectId = normalizedProjectId(input);
+                const rows = await writeManagementEntries({
+                    resource: 'variable',
+                    input,
+                    keys: entries.map((entry)=>entry.key),
+                    listExistingKeys: listExistingVariableManagementKeys,
+                    writeRows: async (tx)=>{
+                        await upsertSecretVariableRows(entries.map((entry)=>({
+                                workspaceId: input.workspaceId,
+                                projectId,
+                                namespace: '',
+                                key: entry.key,
+                                value: entry.value,
+                                lastEditedBy: input.actorId
+                            })), tx);
+                        const rows = await Promise.all(entries.map((entry)=>getVariableManagementRow({
+                                workspaceId: input.workspaceId,
+                                projectId,
+                                key: entry.key
+                            }, tx)));
+                        return rows.map(assertFound);
+                    },
+                    eventTypes: {
+                        created: VARIABLE_CREATED,
+                        updated: VARIABLE_UPDATED
+                    }
+                });
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'set',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return rows;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'set',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async deleteSecret (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                validateSecretKeys([
+                    input.key
+                ]);
+                const deleted = await deleteManagementEntries({
+                    resource: 'secret',
+                    input,
+                    keys: [
+                        input.key
+                    ],
+                    deleteRows: deleteSecretManagementRows,
+                    eventType: SECRET_DELETED
+                });
+                if (deleted === 0) throw new SecretNotFoundError(input.key);
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'delete',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'delete',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async deleteVariable (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                validateSecretKeys([
+                    input.key
+                ]);
+                const deleted = await deleteManagementEntries({
+                    resource: 'variable',
+                    input,
+                    keys: [
+                        input.key
+                    ],
+                    deleteRows: deleteVariableManagementRows,
+                    eventType: VARIABLE_DELETED
+                });
+                if (deleted === 0) throw new VariableNotFoundError(input.key);
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'delete',
+                    surface: 'management',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'variable',
+                    operation: 'delete',
+                    surface: 'management',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        }
+    };
+}
+async function writeManagementEntries(params) {
+    let createdCount = 0;
+    let updatedCount = 0;
+    const rows = await db().transaction(async (tx)=>{
+        await lockWorkspaceEntries(params.input.workspaceId, tx);
+        const existingKeys = await params.listExistingKeys({
+            workspaceId: params.input.workspaceId,
+            projectId: normalizedProjectId(params.input),
+            keys: params.keys
+        }, tx);
+        createdCount = params.keys.length - existingKeys.size;
+        updatedCount = existingKeys.size;
+        await assertWorkspaceCap({
+            workspaceId: params.input.workspaceId,
+            namespace: '',
+            incomingEntries: createdCount,
+            tx
+        });
+        const rows = await params.writeRows(tx);
+        await Promise.all(params.keys.map((key)=>writeOutboxEvent(tx, secretsOutbox, {
+                type: existingKeys.has(key) ? params.eventTypes.updated : params.eventTypes.created,
+                payload: managementEventPayload(params.input, key)
+            })));
+        return rows;
+    });
+    recordSecretsEntriesMutated({
+        resource: params.resource,
+        operation: 'set',
+        effect: 'created',
+        surface: 'management',
+        count: createdCount
+    });
+    recordSecretsEntriesMutated({
+        resource: params.resource,
+        operation: 'set',
+        effect: 'updated',
+        surface: 'management',
+        count: updatedCount
+    });
+    return rows;
+}
+async function deleteManagementEntries(params) {
+    const deleted = await db().transaction(async (tx)=>{
+        await lockWorkspaceEntries(params.input.workspaceId, tx);
+        const rows = await params.deleteRows({
+            workspaceId: params.input.workspaceId,
+            projectId: normalizedProjectId(params.input),
+            keys: params.keys
+        }, tx);
+        await Promise.all(rows.map((row)=>writeOutboxEvent(tx, secretsOutbox, {
+                type: params.eventType,
+                payload: managementEventPayload(params.input, row.key)
+            })));
+        return rows.length;
+    });
+    recordSecretsEntriesMutated({
+        resource: params.resource,
+        operation: 'delete',
+        effect: 'deleted',
+        surface: 'management',
+        count: deleted
+    });
+    return deleted;
+}
+function normalizeEntries(entries) {
+    const valuesByKey = new Map();
+    for (const entry of entries){
+        if (valuesByKey.has(entry.key)) throw new SecretBatchDuplicateKeyError(entry.key);
+        valuesByKey.set(entry.key, entry.value);
+    }
+    return [
+        ...valuesByKey
+    ].map(([key, value])=>({
+            key,
+            value
+        }));
+}
+function managementEventPayload(input, key) {
+    return {
+        actorId: input.actorId,
+        workspaceId: input.workspaceId,
+        projectId: normalizedProjectId(input),
+        key
+    };
+}
+function assertFound(row) {
+    if (!row) throw new Error('Management write returned no row');
+    return row;
+}
+
+//# sourceMappingURL=management.js.map

package/dist/core/management.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/management.ts"],"sourcesContent":["import {\n  SECRET_CREATED,\n  SECRET_DELETED,\n  SECRET_UPDATED,\n  type SecretsEventMap,\n  VARIABLE_CREATED,\n  VARIABLE_DELETED,\n  VARIABLE_UPDATED,\n} from '@shipfox/api-secrets-dto';\nimport {writeOutboxEvent} from '@shipfox/node-outbox';\nimport {\n  db,\n  deleteSecretManagementRows,\n  deleteVariableManagementRows,\n  getSecretManagementRow,\n  getVariableManagementRow,\n  listExistingSecretManagementKeys,\n  listExistingVariableManagementKeys,\n  listSecretManagementRows,\n  listVariableManagementRows,\n  lockWorkspaceEntries,\n  type SecretManagementRow,\n  type StoreScope,\n  secretsOutbox,\n  type Tx,\n  upsertSecretValueRows,\n  upsertSecretVariableRows,\n} from '#db/index.js';\nimport type {SecretVariable} from '#db/schema/variables.js';\nimport {normalizedProjectId} from '#db/scope.js';\nimport {\n  classifySecretsOperationError,\n  operationScope,\n  recordSecretsEntriesMutated,\n  recordSecretsOperation,\n  type SecretsMetricResource,\n} from '#metrics/instance.js';\nimport type {DekManager} from './dek-manager.js';\nimport {\n  SecretBatchDuplicateKeyError,\n  SecretNotFoundError,\n  VariableNotFoundError,\n} from './errors.js';\nimport {fingerprintSecretValue} from './fingerprint.js';\nimport {assertWorkspaceCap, validateSecretKeys, validateValueBytes} from './store-validation.js';\nimport {encryptSecretValue} from './value-cipher.js';\n\nexport interface ManagementEntry {\n  key: string;\n  value: string;\n}\n\nexport interface ManagementWriteParams extends StoreScope {\n  workspaceId: string;\n  entries: ManagementEntry[];\n  actorId: string;\n}\n\nexport interface ManagementKeyParams extends StoreScope {\n  workspaceId: string;\n  key: string;\n  actorId: string;\n}\n\nexport interface ManagementListParams extends StoreScope {\n  workspaceId: string;\n  limit: number;\n  cursor?: string | undefined;\n}\n\nexport function createSecretsManagementApi(params: {dekManager: DekManager}) {\n  return {\n    async listSecrets(input: ManagementListParams) {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const result = await listSecretManagementRows(input);\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'list',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return result;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'list',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async listVariables(input: ManagementListParams) {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const result = await listVariableManagementRows(input);\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'list',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return result;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'list',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async getVariable(\n      input: StoreScope & {workspaceId: string; key: string},\n    ): Promise<SecretVariable> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        validateSecretKeys([input.key]);\n\n        const variable = await getVariableManagementRow(input);\n        if (!variable) throw new VariableNotFoundError(input.key);\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'get',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return variable;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'get',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async setSecrets(input: ManagementWriteParams): Promise<SecretManagementRow[]> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const entries = normalizeEntries(input.entries);\n        validateSecretKeys(entries.map((entry) => entry.key));\n        validateValueBytes(entries.map((entry) => entry.value));\n        if (entries.length === 0) {\n          recordSecretsOperation({\n            resource: 'secret',\n            operation: 'set',\n            surface: 'management',\n            scope,\n            outcome: 'success',\n            durationMs: Date.now() - startedAt,\n          });\n          return [];\n        }\n\n        const projectId = normalizedProjectId(input);\n        const dek = await params.dekManager.getPlaintextDek(input.workspaceId);\n        const rows = await writeManagementEntries({\n          resource: 'secret',\n          input,\n          keys: entries.map((entry) => entry.key),\n          listExistingKeys: listExistingSecretManagementKeys,\n          writeRows: async (tx) => {\n            await upsertSecretValueRows(\n              entries.map((entry) => ({\n                workspaceId: input.workspaceId,\n                projectId,\n                namespace: '',\n                key: entry.key,\n                ciphertext: encryptSecretValue({\n                  dek,\n                  workspaceId: input.workspaceId,\n                  scope: {projectId},\n                  namespace: '',\n                  key: entry.key,\n                  value: entry.value,\n                }),\n                fingerprint: fingerprintSecretValue(entry.value, dek),\n                lastEditedBy: input.actorId,\n              })),\n              tx,\n            );\n            const rows = await Promise.all(\n              entries.map((entry) =>\n                getSecretManagementRow(\n                  {workspaceId: input.workspaceId, projectId, key: entry.key},\n                  tx,\n                ),\n              ),\n            );\n            return rows.map(assertFound);\n          },\n          eventTypes: {created: SECRET_CREATED, updated: SECRET_UPDATED},\n        });\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'set',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return rows;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'set',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async setVariables(input: ManagementWriteParams): Promise<SecretVariable[]> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const entries = normalizeEntries(input.entries);\n        validateSecretKeys(entries.map((entry) => entry.key));\n        validateValueBytes(entries.map((entry) => entry.value));\n        if (entries.length === 0) {\n          recordSecretsOperation({\n            resource: 'variable',\n            operation: 'set',\n            surface: 'management',\n            scope,\n            outcome: 'success',\n            durationMs: Date.now() - startedAt,\n          });\n          return [];\n        }\n\n        const projectId = normalizedProjectId(input);\n        const rows = await writeManagementEntries({\n          resource: 'variable',\n          input,\n          keys: entries.map((entry) => entry.key),\n          listExistingKeys: listExistingVariableManagementKeys,\n          writeRows: async (tx) => {\n            await upsertSecretVariableRows(\n              entries.map((entry) => ({\n                workspaceId: input.workspaceId,\n                projectId,\n                namespace: '',\n                key: entry.key,\n                value: entry.value,\n                lastEditedBy: input.actorId,\n              })),\n              tx,\n            );\n            const rows = await Promise.all(\n              entries.map((entry) =>\n                getVariableManagementRow(\n                  {workspaceId: input.workspaceId, projectId, key: entry.key},\n                  tx,\n                ),\n              ),\n            );\n            return rows.map(assertFound);\n          },\n          eventTypes: {created: VARIABLE_CREATED, updated: VARIABLE_UPDATED},\n        });\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'set',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return rows;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'set',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async deleteSecret(input: ManagementKeyParams): Promise<void> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        validateSecretKeys([input.key]);\n\n        const deleted = await deleteManagementEntries({\n          resource: 'secret',\n          input,\n          keys: [input.key],\n          deleteRows: deleteSecretManagementRows,\n          eventType: SECRET_DELETED,\n        });\n        if (deleted === 0) throw new SecretNotFoundError(input.key);\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'delete',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'delete',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async deleteVariable(input: ManagementKeyParams): Promise<void> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        validateSecretKeys([input.key]);\n\n        const deleted = await deleteManagementEntries({\n          resource: 'variable',\n          input,\n          keys: [input.key],\n          deleteRows: deleteVariableManagementRows,\n          eventType: VARIABLE_DELETED,\n        });\n        if (deleted === 0) throw new VariableNotFoundError(input.key);\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'delete',\n          surface: 'management',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'variable',\n          operation: 'delete',\n          surface: 'management',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n  };\n}\n\nasync function writeManagementEntries<Row extends {key: string}>(params: {\n  resource: SecretsMetricResource;\n  input: ManagementWriteParams;\n  keys: string[];\n  listExistingKeys: (\n    params: StoreScope & {workspaceId: string; keys: string[]},\n    tx: Tx,\n  ) => Promise<Set<string>>;\n  writeRows: (tx: Tx) => Promise<Row[]>;\n  eventTypes: {\n    created: typeof SECRET_CREATED | typeof VARIABLE_CREATED;\n    updated: typeof SECRET_UPDATED | typeof VARIABLE_UPDATED;\n  };\n}): Promise<Row[]> {\n  let createdCount = 0;\n  let updatedCount = 0;\n  const rows = await db().transaction(async (tx) => {\n    await lockWorkspaceEntries(params.input.workspaceId, tx);\n    const existingKeys = await params.listExistingKeys(\n      {\n        workspaceId: params.input.workspaceId,\n        projectId: normalizedProjectId(params.input),\n        keys: params.keys,\n      },\n      tx,\n    );\n    createdCount = params.keys.length - existingKeys.size;\n    updatedCount = existingKeys.size;\n    await assertWorkspaceCap({\n      workspaceId: params.input.workspaceId,\n      namespace: '',\n      incomingEntries: createdCount,\n      tx,\n    });\n\n    const rows = await params.writeRows(tx);\n    await Promise.all(\n      params.keys.map((key) =>\n        writeOutboxEvent<SecretsEventMap>(tx, secretsOutbox, {\n          type: existingKeys.has(key) ? params.eventTypes.updated : params.eventTypes.created,\n          payload: managementEventPayload(params.input, key),\n        }),\n      ),\n    );\n    return rows;\n  });\n  recordSecretsEntriesMutated({\n    resource: params.resource,\n    operation: 'set',\n    effect: 'created',\n    surface: 'management',\n    count: createdCount,\n  });\n  recordSecretsEntriesMutated({\n    resource: params.resource,\n    operation: 'set',\n    effect: 'updated',\n    surface: 'management',\n    count: updatedCount,\n  });\n  return rows;\n}\n\nasync function deleteManagementEntries<Row extends {key: string}>(params: {\n  resource: SecretsMetricResource;\n  input: ManagementKeyParams;\n  keys: string[];\n  deleteRows: (\n    params: StoreScope & {workspaceId: string; keys: string[]},\n    tx: Tx,\n  ) => Promise<Row[]>;\n  eventType: typeof SECRET_DELETED | typeof VARIABLE_DELETED;\n}): Promise<number> {\n  const deleted = await db().transaction(async (tx) => {\n    await lockWorkspaceEntries(params.input.workspaceId, tx);\n    const rows = await params.deleteRows(\n      {\n        workspaceId: params.input.workspaceId,\n        projectId: normalizedProjectId(params.input),\n        keys: params.keys,\n      },\n      tx,\n    );\n    await Promise.all(\n      rows.map((row) =>\n        writeOutboxEvent<SecretsEventMap>(tx, secretsOutbox, {\n          type: params.eventType,\n          payload: managementEventPayload(params.input, row.key),\n        }),\n      ),\n    );\n    return rows.length;\n  });\n  recordSecretsEntriesMutated({\n    resource: params.resource,\n    operation: 'delete',\n    effect: 'deleted',\n    surface: 'management',\n    count: deleted,\n  });\n  return deleted;\n}\n\nfunction normalizeEntries(entries: ManagementEntry[]): ManagementEntry[] {\n  const valuesByKey = new Map<string, string>();\n  for (const entry of entries) {\n    if (valuesByKey.has(entry.key)) throw new SecretBatchDuplicateKeyError(entry.key);\n    valuesByKey.set(entry.key, entry.value);\n  }\n  return [...valuesByKey].map(([key, value]) => ({key, value}));\n}\n\nfunction managementEventPayload(\n  input: Pick<ManagementWriteParams, 'workspaceId' | 'projectId' | 'actorId'>,\n  key: string,\n) {\n  return {\n    actorId: input.actorId,\n    workspaceId: input.workspaceId,\n    projectId: normalizedProjectId(input),\n    key,\n  };\n}\n\nfunction assertFound<Row>(row: Row | undefined): Row {\n  if (!row) throw new Error('Management write returned no row');\n  return row;\n}\n"],"names":["SECRET_CREATED","SECRET_DELETED","SECRET_UPDATED","VARIABLE_CREATED","VARIABLE_DELETED","VARIABLE_UPDATED","writeOutboxEvent","db","deleteSecretManagementRows","deleteVariableManagementRows","getSecretManagementRow","getVariableManagementRow","listExistingSecretManagementKeys","listExistingVariableManagementKeys","listSecretManagementRows","listVariableManagementRows","lockWorkspaceEntries","secretsOutbox","upsertSecretValueRows","upsertSecretVariableRows","normalizedProjectId","classifySecretsOperationError","operationScope","recordSecretsEntriesMutated","recordSecretsOperation","SecretBatchDuplicateKeyError","SecretNotFoundError","VariableNotFoundError","fingerprintSecretValue","assertWorkspaceCap","validateSecretKeys","validateValueBytes","encryptSecretValue","createSecretsManagementApi","params","listSecrets","input","startedAt","Date","now","scope","result","resource","operation","surface","outcome","durationMs","error","listVariables","getVariable","key","variable","setSecrets","entries","normalizeEntries","map","entry","value","length","projectId","dek","dekManager","getPlaintextDek","workspaceId","rows","writeManagementEntries","keys","listExistingKeys","writeRows","tx","namespace","ciphertext","fingerprint","lastEditedBy","actorId","Promise","all","assertFound","eventTypes","created","updated","setVariables","deleteSecret","deleted","deleteManagementEntries","deleteRows","eventType","deleteVariable","createdCount","updatedCount","transaction","existingKeys","size","incomingEntries","type","has","payload","managementEventPayload","effect","count","row","valuesByKey","Map","set","Error"],"mappings":"AAAA,SACEA,cAAc,EACdC,cAAc,EACdC,cAAc,EAEdC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,2BAA2B;AAClC,SAAQC,gBAAgB,QAAO,uBAAuB;AACtD,SACEC,EAAE,EACFC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,sBAAsB,EACtBC,wBAAwB,EACxBC,gCAAgC,EAChCC,kCAAkC,EAClCC,wBAAwB,EACxBC,0BAA0B,EAC1BC,oBAAoB,EAGpBC,aAAa,EAEbC,qBAAqB,EACrBC,wBAAwB,QACnB,eAAe;AAEtB,SAAQC,mBAAmB,QAAO,eAAe;AACjD,SACEC,6BAA6B,EAC7BC,cAAc,EACdC,2BAA2B,EAC3BC,sBAAsB,QAEjB,uBAAuB;AAE9B,SACEC,4BAA4B,EAC5BC,mBAAmB,EACnBC,qBAAqB,QAChB,cAAc;AACrB,SAAQC,sBAAsB,QAAO,mBAAmB;AACxD,SAAQC,kBAAkB,EAAEC,kBAAkB,EAAEC,kBAAkB,QAAO,wBAAwB;AACjG,SAAQC,kBAAkB,QAAO,oBAAoB;AAyBrD,OAAO,SAASC,2BAA2BC,MAAgC;IACzE,OAAO;QACL,MAAMC,aAAYC,KAA2B;YAC3C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACF,MAAMK,SAAS,MAAM3B,yBAAyBsB;gBAC9CZ,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOI;YACT,EAAE,OAAOM,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;QACA,MAAMC,eAAcZ,KAA2B;YAC7C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACF,MAAMK,SAAS,MAAM1B,2BAA2BqB;gBAChDZ,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOI;YACT,EAAE,OAAOM,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;QACA,MAAME,aACJb,KAAsD;YAEtD,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACFN,mBAAmB;oBAACM,MAAMc,GAAG;iBAAC;gBAE9B,MAAMC,WAAW,MAAMxC,yBAAyByB;gBAChD,IAAI,CAACe,UAAU,MAAM,IAAIxB,sBAAsBS,MAAMc,GAAG;gBACxD1B,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOc;YACT,EAAE,OAAOJ,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;QACA,MAAMK,YAAWhB,KAA4B;YAC3C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACF,MAAMiB,UAAUC,iBAAiBlB,MAAMiB,OAAO;gBAC9CvB,mBAAmBuB,QAAQE,GAAG,CAAC,CAACC,QAAUA,MAAMN,GAAG;gBACnDnB,mBAAmBsB,QAAQE,GAAG,CAAC,CAACC,QAAUA,MAAMC,KAAK;gBACrD,IAAIJ,QAAQK,MAAM,KAAK,GAAG;oBACxBlC,uBAAuB;wBACrBkB,UAAU;wBACVC,WAAW;wBACXC,SAAS;wBACTJ;wBACAK,SAAS;wBACTC,YAAYR,KAAKC,GAAG,KAAKF;oBAC3B;oBACA,OAAO,EAAE;gBACX;gBAEA,MAAMsB,YAAYvC,oBAAoBgB;gBACtC,MAAMwB,MAAM,MAAM1B,OAAO2B,UAAU,CAACC,eAAe,CAAC1B,MAAM2B,WAAW;gBACrE,MAAMC,OAAO,MAAMC,uBAAuB;oBACxCvB,UAAU;oBACVN;oBACA8B,MAAMb,QAAQE,GAAG,CAAC,CAACC,QAAUA,MAAMN,GAAG;oBACtCiB,kBAAkBvD;oBAClBwD,WAAW,OAAOC;wBAChB,MAAMnD,sBACJmC,QAAQE,GAAG,CAAC,CAACC,QAAW,CAAA;gCACtBO,aAAa3B,MAAM2B,WAAW;gCAC9BJ;gCACAW,WAAW;gCACXpB,KAAKM,MAAMN,GAAG;gCACdqB,YAAYvC,mBAAmB;oCAC7B4B;oCACAG,aAAa3B,MAAM2B,WAAW;oCAC9BvB,OAAO;wCAACmB;oCAAS;oCACjBW,WAAW;oCACXpB,KAAKM,MAAMN,GAAG;oCACdO,OAAOD,MAAMC,KAAK;gCACpB;gCACAe,aAAa5C,uBAAuB4B,MAAMC,KAAK,EAAEG;gCACjDa,cAAcrC,MAAMsC,OAAO;4BAC7B,CAAA,IACAL;wBAEF,MAAML,OAAO,MAAMW,QAAQC,GAAG,CAC5BvB,QAAQE,GAAG,CAAC,CAACC,QACX9C,uBACE;gCAACqD,aAAa3B,MAAM2B,WAAW;gCAAEJ;gCAAWT,KAAKM,MAAMN,GAAG;4BAAA,GAC1DmB;wBAIN,OAAOL,KAAKT,GAAG,CAACsB;oBAClB;oBACAC,YAAY;wBAACC,SAAS/E;wBAAgBgF,SAAS9E;oBAAc;gBAC/D;gBACAsB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAO2B;YACT,EAAE,OAAOjB,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;QACA,MAAMkC,cAAa7C,KAA4B;YAC7C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACF,MAAMiB,UAAUC,iBAAiBlB,MAAMiB,OAAO;gBAC9CvB,mBAAmBuB,QAAQE,GAAG,CAAC,CAACC,QAAUA,MAAMN,GAAG;gBACnDnB,mBAAmBsB,QAAQE,GAAG,CAAC,CAACC,QAAUA,MAAMC,KAAK;gBACrD,IAAIJ,QAAQK,MAAM,KAAK,GAAG;oBACxBlC,uBAAuB;wBACrBkB,UAAU;wBACVC,WAAW;wBACXC,SAAS;wBACTJ;wBACAK,SAAS;wBACTC,YAAYR,KAAKC,GAAG,KAAKF;oBAC3B;oBACA,OAAO,EAAE;gBACX;gBAEA,MAAMsB,YAAYvC,oBAAoBgB;gBACtC,MAAM4B,OAAO,MAAMC,uBAAuB;oBACxCvB,UAAU;oBACVN;oBACA8B,MAAMb,QAAQE,GAAG,CAAC,CAACC,QAAUA,MAAMN,GAAG;oBACtCiB,kBAAkBtD;oBAClBuD,WAAW,OAAOC;wBAChB,MAAMlD,yBACJkC,QAAQE,GAAG,CAAC,CAACC,QAAW,CAAA;gCACtBO,aAAa3B,MAAM2B,WAAW;gCAC9BJ;gCACAW,WAAW;gCACXpB,KAAKM,MAAMN,GAAG;gCACdO,OAAOD,MAAMC,KAAK;gCAClBgB,cAAcrC,MAAMsC,OAAO;4BAC7B,CAAA,IACAL;wBAEF,MAAML,OAAO,MAAMW,QAAQC,GAAG,CAC5BvB,QAAQE,GAAG,CAAC,CAACC,QACX7C,yBACE;gCAACoD,aAAa3B,MAAM2B,WAAW;gCAAEJ;gCAAWT,KAAKM,MAAMN,GAAG;4BAAA,GAC1DmB;wBAIN,OAAOL,KAAKT,GAAG,CAACsB;oBAClB;oBACAC,YAAY;wBAACC,SAAS5E;wBAAkB6E,SAAS3E;oBAAgB;gBACnE;gBACAmB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAO2B;YACT,EAAE,OAAOjB,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;QACA,MAAMmC,cAAa9C,KAA0B;YAC3C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACFN,mBAAmB;oBAACM,MAAMc,GAAG;iBAAC;gBAE9B,MAAMiC,UAAU,MAAMC,wBAAwB;oBAC5C1C,UAAU;oBACVN;oBACA8B,MAAM;wBAAC9B,MAAMc,GAAG;qBAAC;oBACjBmC,YAAY7E;oBACZ8E,WAAWrF;gBACb;gBACA,IAAIkF,YAAY,GAAG,MAAM,IAAIzD,oBAAoBU,MAAMc,GAAG;gBAC1D1B,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;YACF,EAAE,OAAOU,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;QACA,MAAMwC,gBAAenD,KAA0B;YAC7C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQlB,eAAec;YAC7B,IAAI;gBACFN,mBAAmB;oBAACM,MAAMc,GAAG;iBAAC;gBAE9B,MAAMiC,UAAU,MAAMC,wBAAwB;oBAC5C1C,UAAU;oBACVN;oBACA8B,MAAM;wBAAC9B,MAAMc,GAAG;qBAAC;oBACjBmC,YAAY5E;oBACZ6E,WAAWlF;gBACb;gBACA,IAAI+E,YAAY,GAAG,MAAM,IAAIxD,sBAAsBS,MAAMc,GAAG;gBAC5D1B,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAAS;oBACTC,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;YACF,EAAE,OAAOU,OAAO;gBACdvB,uBAAuB;oBACrBkB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTJ;oBACAK,SAASxB,8BAA8B0B;oBACvCD,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMU;YACR;QACF;IACF;AACF;AAEA,eAAekB,uBAAkD/B,MAahE;IACC,IAAIsD,eAAe;IACnB,IAAIC,eAAe;IACnB,MAAMzB,OAAO,MAAMzD,KAAKmF,WAAW,CAAC,OAAOrB;QACzC,MAAMrD,qBAAqBkB,OAAOE,KAAK,CAAC2B,WAAW,EAAEM;QACrD,MAAMsB,eAAe,MAAMzD,OAAOiC,gBAAgB,CAChD;YACEJ,aAAa7B,OAAOE,KAAK,CAAC2B,WAAW;YACrCJ,WAAWvC,oBAAoBc,OAAOE,KAAK;YAC3C8B,MAAMhC,OAAOgC,IAAI;QACnB,GACAG;QAEFmB,eAAetD,OAAOgC,IAAI,CAACR,MAAM,GAAGiC,aAAaC,IAAI;QACrDH,eAAeE,aAAaC,IAAI;QAChC,MAAM/D,mBAAmB;YACvBkC,aAAa7B,OAAOE,KAAK,CAAC2B,WAAW;YACrCO,WAAW;YACXuB,iBAAiBL;YACjBnB;QACF;QAEA,MAAML,OAAO,MAAM9B,OAAOkC,SAAS,CAACC;QACpC,MAAMM,QAAQC,GAAG,CACf1C,OAAOgC,IAAI,CAACX,GAAG,CAAC,CAACL,MACf5C,iBAAkC+D,IAAIpD,eAAe;gBACnD6E,MAAMH,aAAaI,GAAG,CAAC7C,OAAOhB,OAAO4C,UAAU,CAACE,OAAO,GAAG9C,OAAO4C,UAAU,CAACC,OAAO;gBACnFiB,SAASC,uBAAuB/D,OAAOE,KAAK,EAAEc;YAChD;QAGJ,OAAOc;IACT;IACAzC,4BAA4B;QAC1BmB,UAAUR,OAAOQ,QAAQ;QACzBC,WAAW;QACXuD,QAAQ;QACRtD,SAAS;QACTuD,OAAOX;IACT;IACAjE,4BAA4B;QAC1BmB,UAAUR,OAAOQ,QAAQ;QACzBC,WAAW;QACXuD,QAAQ;QACRtD,SAAS;QACTuD,OAAOV;IACT;IACA,OAAOzB;AACT;AAEA,eAAeoB,wBAAmDlD,MASjE;IACC,MAAMiD,UAAU,MAAM5E,KAAKmF,WAAW,CAAC,OAAOrB;QAC5C,MAAMrD,qBAAqBkB,OAAOE,KAAK,CAAC2B,WAAW,EAAEM;QACrD,MAAML,OAAO,MAAM9B,OAAOmD,UAAU,CAClC;YACEtB,aAAa7B,OAAOE,KAAK,CAAC2B,WAAW;YACrCJ,WAAWvC,oBAAoBc,OAAOE,KAAK;YAC3C8B,MAAMhC,OAAOgC,IAAI;QACnB,GACAG;QAEF,MAAMM,QAAQC,GAAG,CACfZ,KAAKT,GAAG,CAAC,CAAC6C,MACR9F,iBAAkC+D,IAAIpD,eAAe;gBACnD6E,MAAM5D,OAAOoD,SAAS;gBACtBU,SAASC,uBAAuB/D,OAAOE,KAAK,EAAEgE,IAAIlD,GAAG;YACvD;QAGJ,OAAOc,KAAKN,MAAM;IACpB;IACAnC,4BAA4B;QAC1BmB,UAAUR,OAAOQ,QAAQ;QACzBC,WAAW;QACXuD,QAAQ;QACRtD,SAAS;QACTuD,OAAOhB;IACT;IACA,OAAOA;AACT;AAEA,SAAS7B,iBAAiBD,OAA0B;IAClD,MAAMgD,cAAc,IAAIC;IACxB,KAAK,MAAM9C,SAASH,QAAS;QAC3B,IAAIgD,YAAYN,GAAG,CAACvC,MAAMN,GAAG,GAAG,MAAM,IAAIzB,6BAA6B+B,MAAMN,GAAG;QAChFmD,YAAYE,GAAG,CAAC/C,MAAMN,GAAG,EAAEM,MAAMC,KAAK;IACxC;IACA,OAAO;WAAI4C;KAAY,CAAC9C,GAAG,CAAC,CAAC,CAACL,KAAKO,MAAM,GAAM,CAAA;YAACP;YAAKO;QAAK,CAAA;AAC5D;AAEA,SAASwC,uBACP7D,KAA2E,EAC3Ec,GAAW;IAEX,OAAO;QACLwB,SAAStC,MAAMsC,OAAO;QACtBX,aAAa3B,MAAM2B,WAAW;QAC9BJ,WAAWvC,oBAAoBgB;QAC/Bc;IACF;AACF;AAEA,SAAS2B,YAAiBuB,GAAoB;IAC5C,IAAI,CAACA,KAAK,MAAM,IAAII,MAAM;IAC1B,OAAOJ;AACT"}

package/dist/core/rotate-kek.d.ts

@@ -0,0 +1,10 @@
+import type { KeyProvider } from './key-provider.js';
+export interface RotateWorkspaceDataKeysResult {
+    rotated: number;
+    skipped: number;
+}
+export interface RotateWorkspaceDataKeysOptions {
+    workspaceIds?: string[] | undefined;
+}
+export declare function rotateWorkspaceDataKeysWithProvider(keyProvider: KeyProvider, options?: RotateWorkspaceDataKeysOptions): Promise<RotateWorkspaceDataKeysResult>;
+//# sourceMappingURL=rotate-kek.d.ts.map

package/dist/core/rotate-kek.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-kek.d.ts","sourceRoot":"","sources":["../../src/core/rotate-kek.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,mBAAmB,CAAC;AAInD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC;AAED,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,WAAW,EACxB,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CAqExC"}

package/dist/core/rotate-kek.js

@@ -0,0 +1,94 @@
+import { listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas } from '#db/index.js';
+import { classifyKekRotationError, recordSecretsKekRotation } from '#metrics/instance.js';
+import { KekVersionStrandedError } from './errors.js';
+const PAGE_SIZE = 100;
+export async function rotateWorkspaceDataKeysWithProvider(keyProvider, options = {}) {
+    const startedAt = Date.now();
+    try {
+        const knownVersions = [
+            keyProvider.currentKeyVersion,
+            keyProvider.previousKeyVersion
+        ].filter((version)=>Boolean(version));
+        const unknownVersions = await listDataKeyVersions(knownVersions, {
+            workspaceIds: options.workspaceIds
+        });
+        if (unknownVersions.length > 0) throw new KekVersionStrandedError(unknownVersions[0]);
+        let rotated = 0;
+        let skipped = 0;
+        let skippedCurrent = 0;
+        let skippedRace = 0;
+        let afterWorkspaceId;
+        while(true){
+            const page = await listDataKeysPage({
+                afterWorkspaceId,
+                limit: PAGE_SIZE,
+                workspaceIds: options.workspaceIds
+            });
+            if (page.length === 0) break;
+            for (const row of page){
+                afterWorkspaceId = row.workspaceId;
+                if (row.kekVersion === keyProvider.currentKeyVersion) {
+                    skipped += 1;
+                    skippedCurrent += 1;
+                    continue;
+                }
+                const plaintextDek = keyProvider.unwrapDek(row.workspaceId, row.wrappedDek, row.kekVersion);
+                try {
+                    const wrapped = keyProvider.wrapDek(row.workspaceId, plaintextDek);
+                    const updated = await updateDataKeyWrapCas({
+                        workspaceId: row.workspaceId,
+                        oldKekVersion: row.kekVersion,
+                        wrappedDek: wrapped.wrappedDek,
+                        kekVersion: wrapped.kekVersion
+                    });
+                    if (updated) rotated += 1;
+                    else {
+                        skipped += 1;
+                        skippedRace += 1;
+                    }
+                } finally{
+                    plaintextDek.fill(0);
+                }
+            }
+        }
+        recordSecretsKekRotation({
+            outcome: 'rotated',
+            count: rotated
+        });
+        recordSecretsKekRotation({
+            outcome: 'skipped_current',
+            count: skippedCurrent
+        });
+        recordSecretsKekRotation({
+            outcome: 'skipped_race',
+            count: skippedRace
+        });
+        recordSecretsKekRotation({
+            outcome: rotationDurationOutcome({
+                rotated,
+                skippedCurrent,
+                skippedRace
+            }),
+            count: 0,
+            durationMs: Date.now() - startedAt
+        });
+        return {
+            rotated,
+            skipped
+        };
+    } catch (error) {
+        recordSecretsKekRotation({
+            outcome: classifyKekRotationError(error),
+            durationMs: Date.now() - startedAt
+        });
+        throw error;
+    }
+}
+function rotationDurationOutcome(params) {
+    if (params.rotated > 0) return 'rotated';
+    if (params.skippedRace > 0) return 'skipped_race';
+    if (params.skippedCurrent === 0) return 'none';
+    return 'skipped_current';
+}
+
+//# sourceMappingURL=rotate-kek.js.map

package/dist/core/rotate-kek.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/rotate-kek.ts"],"sourcesContent":["import {listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas} from '#db/index.js';\nimport {classifyKekRotationError, recordSecretsKekRotation} from '#metrics/instance.js';\nimport {KekVersionStrandedError} from './errors.js';\nimport type {KeyProvider} from './key-provider.js';\n\nconst PAGE_SIZE = 100;\n\nexport interface RotateWorkspaceDataKeysResult {\n  rotated: number;\n  skipped: number;\n}\n\nexport interface RotateWorkspaceDataKeysOptions {\n  workspaceIds?: string[] | undefined;\n}\n\nexport async function rotateWorkspaceDataKeysWithProvider(\n  keyProvider: KeyProvider,\n  options: RotateWorkspaceDataKeysOptions = {},\n): Promise<RotateWorkspaceDataKeysResult> {\n  const startedAt = Date.now();\n  try {\n    const knownVersions = [keyProvider.currentKeyVersion, keyProvider.previousKeyVersion].filter(\n      (version): version is string => Boolean(version),\n    );\n    const unknownVersions = await listDataKeyVersions(knownVersions, {\n      workspaceIds: options.workspaceIds,\n    });\n    if (unknownVersions.length > 0) throw new KekVersionStrandedError(unknownVersions[0] as string);\n\n    let rotated = 0;\n    let skipped = 0;\n    let skippedCurrent = 0;\n    let skippedRace = 0;\n    let afterWorkspaceId: string | undefined;\n\n    while (true) {\n      const page = await listDataKeysPage({\n        afterWorkspaceId,\n        limit: PAGE_SIZE,\n        workspaceIds: options.workspaceIds,\n      });\n      if (page.length === 0) break;\n\n      for (const row of page) {\n        afterWorkspaceId = row.workspaceId;\n        if (row.kekVersion === keyProvider.currentKeyVersion) {\n          skipped += 1;\n          skippedCurrent += 1;\n          continue;\n        }\n\n        const plaintextDek = keyProvider.unwrapDek(row.workspaceId, row.wrappedDek, row.kekVersion);\n        try {\n          const wrapped = keyProvider.wrapDek(row.workspaceId, plaintextDek);\n          const updated = await updateDataKeyWrapCas({\n            workspaceId: row.workspaceId,\n            oldKekVersion: row.kekVersion,\n            wrappedDek: wrapped.wrappedDek,\n            kekVersion: wrapped.kekVersion,\n          });\n          if (updated) rotated += 1;\n          else {\n            skipped += 1;\n            skippedRace += 1;\n          }\n        } finally {\n          plaintextDek.fill(0);\n        }\n      }\n    }\n\n    recordSecretsKekRotation({outcome: 'rotated', count: rotated});\n    recordSecretsKekRotation({outcome: 'skipped_current', count: skippedCurrent});\n    recordSecretsKekRotation({outcome: 'skipped_race', count: skippedRace});\n    recordSecretsKekRotation({\n      outcome: rotationDurationOutcome({rotated, skippedCurrent, skippedRace}),\n      count: 0,\n      durationMs: Date.now() - startedAt,\n    });\n    return {rotated, skipped};\n  } catch (error) {\n    recordSecretsKekRotation({\n      outcome: classifyKekRotationError(error),\n      durationMs: Date.now() - startedAt,\n    });\n    throw error;\n  }\n}\n\nfunction rotationDurationOutcome(params: {\n  rotated: number;\n  skippedCurrent: number;\n  skippedRace: number;\n}) {\n  if (params.rotated > 0) return 'rotated';\n  if (params.skippedRace > 0) return 'skipped_race';\n  if (params.skippedCurrent === 0) return 'none';\n  return 'skipped_current';\n}\n"],"names":["listDataKeysPage","listDataKeyVersions","updateDataKeyWrapCas","classifyKekRotationError","recordSecretsKekRotation","KekVersionStrandedError","PAGE_SIZE","rotateWorkspaceDataKeysWithProvider","keyProvider","options","startedAt","Date","now","knownVersions","currentKeyVersion","previousKeyVersion","filter","version","Boolean","unknownVersions","workspaceIds","length","rotated","skipped","skippedCurrent","skippedRace","afterWorkspaceId","page","limit","row","workspaceId","kekVersion","plaintextDek","unwrapDek","wrappedDek","wrapped","wrapDek","updated","oldKekVersion","fill","outcome","count","rotationDurationOutcome","durationMs","error","params"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,mBAAmB,EAAEC,oBAAoB,QAAO,eAAe;AACzF,SAAQC,wBAAwB,EAAEC,wBAAwB,QAAO,uBAAuB;AACxF,SAAQC,uBAAuB,QAAO,cAAc;AAGpD,MAAMC,YAAY;AAWlB,OAAO,eAAeC,oCACpBC,WAAwB,EACxBC,UAA0C,CAAC,CAAC;IAE5C,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,IAAI;QACF,MAAMC,gBAAgB;YAACL,YAAYM,iBAAiB;YAAEN,YAAYO,kBAAkB;SAAC,CAACC,MAAM,CAC1F,CAACC,UAA+BC,QAAQD;QAE1C,MAAME,kBAAkB,MAAMlB,oBAAoBY,eAAe;YAC/DO,cAAcX,QAAQW,YAAY;QACpC;QACA,IAAID,gBAAgBE,MAAM,GAAG,GAAG,MAAM,IAAIhB,wBAAwBc,eAAe,CAAC,EAAE;QAEpF,IAAIG,UAAU;QACd,IAAIC,UAAU;QACd,IAAIC,iBAAiB;QACrB,IAAIC,cAAc;QAClB,IAAIC;QAEJ,MAAO,KAAM;YACX,MAAMC,OAAO,MAAM3B,iBAAiB;gBAClC0B;gBACAE,OAAOtB;gBACPc,cAAcX,QAAQW,YAAY;YACpC;YACA,IAAIO,KAAKN,MAAM,KAAK,GAAG;YAEvB,KAAK,MAAMQ,OAAOF,KAAM;gBACtBD,mBAAmBG,IAAIC,WAAW;gBAClC,IAAID,IAAIE,UAAU,KAAKvB,YAAYM,iBAAiB,EAAE;oBACpDS,WAAW;oBACXC,kBAAkB;oBAClB;gBACF;gBAEA,MAAMQ,eAAexB,YAAYyB,SAAS,CAACJ,IAAIC,WAAW,EAAED,IAAIK,UAAU,EAAEL,IAAIE,UAAU;gBAC1F,IAAI;oBACF,MAAMI,UAAU3B,YAAY4B,OAAO,CAACP,IAAIC,WAAW,EAAEE;oBACrD,MAAMK,UAAU,MAAMnC,qBAAqB;wBACzC4B,aAAaD,IAAIC,WAAW;wBAC5BQ,eAAeT,IAAIE,UAAU;wBAC7BG,YAAYC,QAAQD,UAAU;wBAC9BH,YAAYI,QAAQJ,UAAU;oBAChC;oBACA,IAAIM,SAASf,WAAW;yBACnB;wBACHC,WAAW;wBACXE,eAAe;oBACjB;gBACF,SAAU;oBACRO,aAAaO,IAAI,CAAC;gBACpB;YACF;QACF;QAEAnC,yBAAyB;YAACoC,SAAS;YAAWC,OAAOnB;QAAO;QAC5DlB,yBAAyB;YAACoC,SAAS;YAAmBC,OAAOjB;QAAc;QAC3EpB,yBAAyB;YAACoC,SAAS;YAAgBC,OAAOhB;QAAW;QACrErB,yBAAyB;YACvBoC,SAASE,wBAAwB;gBAACpB;gBAASE;gBAAgBC;YAAW;YACtEgB,OAAO;YACPE,YAAYhC,KAAKC,GAAG,KAAKF;QAC3B;QACA,OAAO;YAACY;YAASC;QAAO;IAC1B,EAAE,OAAOqB,OAAO;QACdxC,yBAAyB;YACvBoC,SAASrC,yBAAyByC;YAClCD,YAAYhC,KAAKC,GAAG,KAAKF;QAC3B;QACA,MAAMkC;IACR;AACF;AAEA,SAASF,wBAAwBG,MAIhC;IACC,IAAIA,OAAOvB,OAAO,GAAG,GAAG,OAAO;IAC/B,IAAIuB,OAAOpB,WAAW,GAAG,GAAG,OAAO;IACnC,IAAIoB,OAAOrB,cAAc,KAAK,GAAG,OAAO;IACxC,OAAO;AACT"}

package/dist/core/secret-store.d.ts

@@ -0,0 +1,33 @@
+import { type StoreScope } from '#db/index.js';
+import type { DekManager } from './dek-manager.js';
+import type { SecretStoreProvider } from './store-resolver.js';
+export interface SetSecretsParams extends StoreScope {
+    workspaceId: string;
+    namespace?: string | undefined;
+    values: Record<string, string>;
+    editedBy?: string | null | undefined;
+}
+export interface DeleteSecretsParams extends StoreScope {
+    workspaceId: string;
+    namespace?: string | undefined;
+    keys?: string[] | undefined;
+}
+export declare function createSecretStoreApi(params: {
+    dekManager: DekManager;
+    resolveSecretStore: (name?: string | undefined) => SecretStoreProvider;
+}): {
+    getSecret(input: StoreScope & {
+        workspaceId: string;
+        namespace?: string | undefined;
+        key: string;
+        store?: string;
+    }): Promise<string | null>;
+    getSecretsByNamespace(input: StoreScope & {
+        workspaceId: string;
+        namespace?: string | undefined;
+        store?: string;
+    }): Promise<Record<string, string>>;
+    setSecrets(input: SetSecretsParams): Promise<void>;
+    deleteSecrets(input: DeleteSecretsParams): Promise<number>;
+};
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/core/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/core/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAEhB,MAAM,cAAc,CAAC;AAQtB,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AAS7D,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7B;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,mBAAmB,CAAC;CACxE;qBAGY,UAAU,GAAG;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB;iCA+BM,UAAU,GAAG;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC;sBA+BnE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;yBA+F7B,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;EA2CnE"}