@shipfox/api-secrets 2.0.0

package/dist/db/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAOnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B;AAED,MAAM,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/db/db.js

@@ -0,0 +1,24 @@
+import { drizzle } from '@shipfox/node-drizzle';
+import { pgClient } from '@shipfox/node-postgres';
+import { secretDataKeys } from './schema/data-keys.js';
+import { secretsOutbox } from './schema/outbox.js';
+import { secretValues } from './schema/values.js';
+import { secretVariables } from './schema/variables.js';
+export const schema = {
+    secretDataKeys,
+    secretsOutbox,
+    secretValues,
+    secretVariables
+};
+let _db;
+export function db() {
+    if (!_db) _db = drizzle(pgClient(), {
+        schema
+    });
+    return _db;
+}
+export function closeDb() {
+    _db = undefined;
+}
+
+//# sourceMappingURL=db.js.map

package/dist/db/db.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {secretDataKeys} from './schema/data-keys.js';\nimport {secretsOutbox} from './schema/outbox.js';\nimport {secretValues} from './schema/values.js';\nimport {secretVariables} from './schema/variables.js';\n\nexport const schema = {\n  secretDataKeys,\n  secretsOutbox,\n  secretValues,\n  secretVariables,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n\nexport type Tx = Parameters<Parameters<NodePgDatabase<typeof schema>['transaction']>[0]>[0];\n"],"names":["drizzle","pgClient","secretDataKeys","secretsOutbox","secretValues","secretVariables","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,cAAc,QAAO,wBAAwB;AACrD,SAAQC,aAAa,QAAO,qBAAqB;AACjD,SAAQC,YAAY,QAAO,qBAAqB;AAChD,SAAQC,eAAe,QAAO,wBAAwB;AAEtD,OAAO,MAAMC,SAAS;IACpBJ;IACAC;IACAC;IACAC;AACF,EAAE;AAEF,IAAIE;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMP,QAAQC,YAAY;QAACK;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/index.d.ts

@@ -0,0 +1,13 @@
+export { countPublicEntriesByResource, countWorkspaceEntries, lockWorkspaceEntries } from './cap.js';
+export { getDataKey, insertDataKeyIfAbsent, listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas, } from './data-keys.js';
+export { closeDb, db, schema, type Tx } from './db.js';
+export { deleteSecretManagementRows, deleteVariableManagementRows, getSecretManagementRow, getVariableManagementRow, listExistingSecretManagementKeys, listExistingVariableManagementKeys, listSecretManagementRows, listVariableManagementRows, type SecretManagementRow, type VariableManagementListRow, } from './management.js';
+export { secretDataKeys } from './schema/data-keys.js';
+export { secretsOutbox } from './schema/outbox.js';
+export { secretValues } from './schema/values.js';
+export { secretVariables } from './schema/variables.js';
+export type { StoreScope } from './scope.js';
+export { countSecretValueRows, deleteSecretValueRows, getSecretValueRowWithPrecedence, listSecretValueRowsByNamespace, upsertSecretValueRows, } from './values.js';
+export { countSecretVariableRows, deleteSecretVariableRows, getSecretVariableRowWithPrecedence, listSecretVariableRowsByNamespace, upsertSecretVariableRows, } from './variables.js';
+export declare const migrationsPath: string;
+//# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,4BAA4B,EAAE,qBAAqB,EAAE,oBAAoB,EAAC,MAAM,UAAU,CAAC;AACnG,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAC,MAAM,SAAS,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,gCAAgC,EAChC,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAC,YAAY,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AACtD,YAAY,EAAC,UAAU,EAAC,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,kCAAkC,EAClC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,cAAc,QAAoE,CAAC"}

package/dist/db/index.js

@@ -0,0 +1,15 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export { countPublicEntriesByResource, countWorkspaceEntries, lockWorkspaceEntries } from './cap.js';
+export { getDataKey, insertDataKeyIfAbsent, listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas } from './data-keys.js';
+export { closeDb, db, schema } from './db.js';
+export { deleteSecretManagementRows, deleteVariableManagementRows, getSecretManagementRow, getVariableManagementRow, listExistingSecretManagementKeys, listExistingVariableManagementKeys, listSecretManagementRows, listVariableManagementRows } from './management.js';
+export { secretDataKeys } from './schema/data-keys.js';
+export { secretsOutbox } from './schema/outbox.js';
+export { secretValues } from './schema/values.js';
+export { secretVariables } from './schema/variables.js';
+export { countSecretValueRows, deleteSecretValueRows, getSecretValueRowWithPrecedence, listSecretValueRowsByNamespace, upsertSecretValueRows } from './values.js';
+export { countSecretVariableRows, deleteSecretVariableRows, getSecretVariableRowWithPrecedence, listSecretVariableRowsByNamespace, upsertSecretVariableRows } from './variables.js';
+export const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');
+
+//# sourceMappingURL=index.js.map

package/dist/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/index.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\n\nexport {countPublicEntriesByResource, countWorkspaceEntries, lockWorkspaceEntries} from './cap.js';\nexport {\n  getDataKey,\n  insertDataKeyIfAbsent,\n  listDataKeysPage,\n  listDataKeyVersions,\n  updateDataKeyWrapCas,\n} from './data-keys.js';\nexport {closeDb, db, schema, type Tx} from './db.js';\nexport {\n  deleteSecretManagementRows,\n  deleteVariableManagementRows,\n  getSecretManagementRow,\n  getVariableManagementRow,\n  listExistingSecretManagementKeys,\n  listExistingVariableManagementKeys,\n  listSecretManagementRows,\n  listVariableManagementRows,\n  type SecretManagementRow,\n  type VariableManagementListRow,\n} from './management.js';\nexport {secretDataKeys} from './schema/data-keys.js';\nexport {secretsOutbox} from './schema/outbox.js';\nexport {secretValues} from './schema/values.js';\nexport {secretVariables} from './schema/variables.js';\nexport type {StoreScope} from './scope.js';\nexport {\n  countSecretValueRows,\n  deleteSecretValueRows,\n  getSecretValueRowWithPrecedence,\n  listSecretValueRowsByNamespace,\n  upsertSecretValueRows,\n} from './values.js';\nexport {\n  countSecretVariableRows,\n  deleteSecretVariableRows,\n  getSecretVariableRowWithPrecedence,\n  listSecretVariableRowsByNamespace,\n  upsertSecretVariableRows,\n} from './variables.js';\n\nexport const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');\n"],"names":["dirname","resolve","fileURLToPath","countPublicEntriesByResource","countWorkspaceEntries","lockWorkspaceEntries","getDataKey","insertDataKeyIfAbsent","listDataKeysPage","listDataKeyVersions","updateDataKeyWrapCas","closeDb","db","schema","deleteSecretManagementRows","deleteVariableManagementRows","getSecretManagementRow","getVariableManagementRow","listExistingSecretManagementKeys","listExistingVariableManagementKeys","listSecretManagementRows","listVariableManagementRows","secretDataKeys","secretsOutbox","secretValues","secretVariables","countSecretValueRows","deleteSecretValueRows","getSecretValueRowWithPrecedence","listSecretValueRowsByNamespace","upsertSecretValueRows","countSecretVariableRows","deleteSecretVariableRows","getSecretVariableRowWithPrecedence","listSecretVariableRowsByNamespace","upsertSecretVariableRows","migrationsPath","url"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AAEvC,SAAQC,4BAA4B,EAAEC,qBAAqB,EAAEC,oBAAoB,QAAO,WAAW;AACnG,SACEC,UAAU,EACVC,qBAAqB,EACrBC,gBAAgB,EAChBC,mBAAmB,EACnBC,oBAAoB,QACf,iBAAiB;AACxB,SAAQC,OAAO,EAAEC,EAAE,EAAEC,MAAM,QAAgB,UAAU;AACrD,SACEC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,sBAAsB,EACtBC,wBAAwB,EACxBC,gCAAgC,EAChCC,kCAAkC,EAClCC,wBAAwB,EACxBC,0BAA0B,QAGrB,kBAAkB;AACzB,SAAQC,cAAc,QAAO,wBAAwB;AACrD,SAAQC,aAAa,QAAO,qBAAqB;AACjD,SAAQC,YAAY,QAAO,qBAAqB;AAChD,SAAQC,eAAe,QAAO,wBAAwB;AAEtD,SACEC,oBAAoB,EACpBC,qBAAqB,EACrBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,qBAAqB,QAChB,cAAc;AACrB,SACEC,uBAAuB,EACvBC,wBAAwB,EACxBC,kCAAkC,EAClCC,iCAAiC,EACjCC,wBAAwB,QACnB,iBAAiB;AAExB,OAAO,MAAMC,iBAAiBnC,QAAQD,QAAQE,cAAc,YAAYmC,GAAG,IAAI,iBAAiB"}

package/dist/db/management.d.ts

@@ -0,0 +1,50 @@
+import type { Tx } from './db.js';
+import { type SecretValue } from './schema/values.js';
+import { type SecretVariable } from './schema/variables.js';
+import { type StoreScope } from './scope.js';
+export interface ManagementListParams extends StoreScope {
+    workspaceId: string;
+    limit: number;
+    cursor?: string | undefined;
+}
+export type SecretManagementRow = Omit<SecretValue, 'ciphertext' | 'fingerprint'>;
+export declare const VARIABLE_LIST_VALUE_PREVIEW_LENGTH = 256;
+/** A variable list row whose `value` is a preview; `valueTruncated` flags that more exists. */
+export interface VariableManagementListRow extends SecretVariable {
+    valueTruncated: boolean;
+}
+export interface SecretManagementListResult {
+    secrets: SecretManagementRow[];
+    nextCursor: string | null;
+}
+export interface VariableManagementListResult {
+    variables: VariableManagementListRow[];
+    nextCursor: string | null;
+}
+export declare function listSecretManagementRows(params: ManagementListParams, tx?: Tx): Promise<SecretManagementListResult>;
+export declare function listVariableManagementRows(params: ManagementListParams, tx?: Tx): Promise<VariableManagementListResult>;
+export declare function getSecretManagementRow(params: StoreScope & {
+    workspaceId: string;
+    key: string;
+}, tx?: Tx): Promise<SecretManagementRow | undefined>;
+export declare function getVariableManagementRow(params: StoreScope & {
+    workspaceId: string;
+    key: string;
+}, tx?: Tx): Promise<SecretVariable | undefined>;
+export declare function listExistingSecretManagementKeys(params: StoreScope & {
+    workspaceId: string;
+    keys: string[];
+}, tx: Tx): Promise<Set<string>>;
+export declare function listExistingVariableManagementKeys(params: StoreScope & {
+    workspaceId: string;
+    keys: string[];
+}, tx: Tx): Promise<Set<string>>;
+export declare function deleteSecretManagementRows(params: StoreScope & {
+    workspaceId: string;
+    keys: string[];
+}, tx: Tx): Promise<SecretManagementRow[]>;
+export declare function deleteVariableManagementRows(params: StoreScope & {
+    workspaceId: string;
+    keys: string[];
+}, tx: Tx): Promise<SecretVariable[]>;
+//# sourceMappingURL=management.d.ts.map

package/dist/db/management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.d.ts","sourceRoot":"","sources":["../../src/db/management.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAEhC,OAAO,EAAC,KAAK,WAAW,EAAe,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAC,KAAK,cAAc,EAAoC,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAsB,KAAK,UAAU,EAAC,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC;AAMlF,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,+FAA+F;AAC/F,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,yBAAyB,EAAE,CAAC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,oBAAoB,EAC5B,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,0BAA0B,CAAC,CAiBrC;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,oBAAoB,EAC5B,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,4BAA4B,CAAC,CA0CvC;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,EACvD,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAU1C;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,EACvD,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAUrC;AAED,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAC1D,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAStB;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAC1D,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAWtB;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAC1D,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAShC;AAwCD,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAC1D,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,cAAc,EAAE,CAAC,CAW3B"}

package/dist/db/management.js

@@ -0,0 +1,127 @@
+import { and, asc, eq, gt, inArray, isNull, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { secretValues } from './schema/values.js';
+import { secretVariables, toSecretVariable } from './schema/variables.js';
+import { normalizedProjectId } from './scope.js';
+// Values can be large and multi-line, so the list returns only a bounded, single-line
+// preview (the value's first line, capped at this many characters). The full value is
+// fetched on demand via getVariableManagementRow. This keeps a single-call list of the
+// whole bounded set from materializing hundreds of MB server-side.
+export const VARIABLE_LIST_VALUE_PREVIEW_LENGTH = 256;
+export async function listSecretManagementRows(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.select(secretManagementColumns).from(secretValues).where(and(...managementFilters(secretValues, params))).orderBy(asc(secretValues.key)).limit(params.limit + 1);
+    const hasMore = rows.length > params.limit;
+    const pageRows = hasMore ? rows.slice(0, params.limit) : rows;
+    const last = pageRows.at(-1);
+    return {
+        secrets: pageRows.map(toSecretManagementRow),
+        nextCursor: hasMore && last ? last.key : null
+    };
+}
+export async function listVariableManagementRows(params, tx) {
+    const executor = tx ?? db();
+    // Preview = the value's first line, capped at the preview length. `valueTruncated`
+    // is true whenever the stored value differs from that preview (longer, or multi-line).
+    const valuePreview = sql`left(split_part(${secretVariables.value}, chr(10), 1), ${VARIABLE_LIST_VALUE_PREVIEW_LENGTH})`;
+    const rows = await executor.select({
+        id: secretVariables.id,
+        workspaceId: secretVariables.workspaceId,
+        projectId: secretVariables.projectId,
+        namespace: secretVariables.namespace,
+        key: secretVariables.key,
+        createdAt: secretVariables.createdAt,
+        updatedAt: secretVariables.updatedAt,
+        lastEditedBy: secretVariables.lastEditedBy,
+        valuePreview,
+        valueTruncated: sql`${secretVariables.value} <> ${valuePreview}`
+    }).from(secretVariables).where(and(...managementFilters(secretVariables, params))).orderBy(asc(secretVariables.key)).limit(params.limit + 1);
+    const hasMore = rows.length > params.limit;
+    const pageRows = hasMore ? rows.slice(0, params.limit) : rows;
+    const last = pageRows.at(-1);
+    return {
+        variables: pageRows.map((row)=>({
+                id: row.id,
+                workspaceId: row.workspaceId,
+                projectId: row.projectId,
+                namespace: row.namespace,
+                key: row.key,
+                value: row.valuePreview,
+                valueTruncated: row.valueTruncated,
+                createdAt: row.createdAt,
+                updatedAt: row.updatedAt,
+                lastEditedBy: row.lastEditedBy
+            })),
+        nextCursor: hasMore && last ? last.key : null
+    };
+}
+export async function getSecretManagementRow(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.select(secretManagementColumns).from(secretValues).where(and(...managementFilters(secretValues, params), eq(secretValues.key, params.key))).limit(1);
+    const row = rows[0];
+    return row ? toSecretManagementRow(row) : undefined;
+}
+export async function getVariableManagementRow(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.select().from(secretVariables).where(and(...managementFilters(secretVariables, params), eq(secretVariables.key, params.key))).limit(1);
+    const row = rows[0];
+    return row ? toSecretVariable(row) : undefined;
+}
+export async function listExistingSecretManagementKeys(params, tx) {
+    if (params.keys.length === 0) return new Set();
+    const rows = await tx.select({
+        key: secretValues.key
+    }).from(secretValues).where(and(...managementFilters(secretValues, params), inArray(secretValues.key, params.keys)));
+    return new Set(rows.map((row)=>row.key));
+}
+export async function listExistingVariableManagementKeys(params, tx) {
+    if (params.keys.length === 0) return new Set();
+    const rows = await tx.select({
+        key: secretVariables.key
+    }).from(secretVariables).where(and(...managementFilters(secretVariables, params), inArray(secretVariables.key, params.keys)));
+    return new Set(rows.map((row)=>row.key));
+}
+export async function deleteSecretManagementRows(params, tx) {
+    if (params.keys.length === 0) return [];
+    const rows = await tx.delete(secretValues).where(and(...managementFilters(secretValues, params), inArray(secretValues.key, params.keys))).returning(secretManagementColumns);
+    return rows.map(toSecretManagementRow);
+}
+const secretManagementColumns = {
+    id: secretValues.id,
+    workspaceId: secretValues.workspaceId,
+    projectId: secretValues.projectId,
+    namespace: secretValues.namespace,
+    key: secretValues.key,
+    createdAt: secretValues.createdAt,
+    updatedAt: secretValues.updatedAt,
+    lastEditedBy: secretValues.lastEditedBy
+};
+function toSecretManagementRow(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspaceId,
+        projectId: row.projectId,
+        namespace: row.namespace,
+        key: row.key,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        lastEditedBy: row.lastEditedBy
+    };
+}
+export async function deleteVariableManagementRows(params, tx) {
+    if (params.keys.length === 0) return [];
+    const rows = await tx.delete(secretVariables).where(and(...managementFilters(secretVariables, params), inArray(secretVariables.key, params.keys))).returning();
+    return rows.map(toSecretVariable);
+}
+function managementFilters(table, params) {
+    const projectId = normalizedProjectId(params);
+    const filters = [
+        eq(table.workspaceId, params.workspaceId),
+        eq(table.namespace, ''),
+        projectId ? eq(table.projectId, projectId) : isNull(table.projectId)
+    ];
+    if (params.cursor) filters.push(gt(table.key, params.cursor));
+    return filters;
+}
+
+//# sourceMappingURL=management.js.map

package/dist/db/management.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/management.ts"],"sourcesContent":["import {and, asc, eq, gt, inArray, isNull, type SQL, sql} from 'drizzle-orm';\nimport type {AnyPgColumn} from 'drizzle-orm/pg-core';\nimport type {Tx} from './db.js';\nimport {db} from './db.js';\nimport {type SecretValue, secretValues} from './schema/values.js';\nimport {type SecretVariable, secretVariables, toSecretVariable} from './schema/variables.js';\nimport {normalizedProjectId, type StoreScope} from './scope.js';\n\nexport interface ManagementListParams extends StoreScope {\n  workspaceId: string;\n  limit: number;\n  cursor?: string | undefined;\n}\n\nexport type SecretManagementRow = Omit<SecretValue, 'ciphertext' | 'fingerprint'>;\n\n// Values can be large and multi-line, so the list returns only a bounded, single-line\n// preview (the value's first line, capped at this many characters). The full value is\n// fetched on demand via getVariableManagementRow. This keeps a single-call list of the\n// whole bounded set from materializing hundreds of MB server-side.\nexport const VARIABLE_LIST_VALUE_PREVIEW_LENGTH = 256;\n\n/** A variable list row whose `value` is a preview; `valueTruncated` flags that more exists. */\nexport interface VariableManagementListRow extends SecretVariable {\n  valueTruncated: boolean;\n}\n\nexport interface SecretManagementListResult {\n  secrets: SecretManagementRow[];\n  nextCursor: string | null;\n}\n\nexport interface VariableManagementListResult {\n  variables: VariableManagementListRow[];\n  nextCursor: string | null;\n}\n\nexport async function listSecretManagementRows(\n  params: ManagementListParams,\n  tx?: Tx,\n): Promise<SecretManagementListResult> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .select(secretManagementColumns)\n    .from(secretValues)\n    .where(and(...managementFilters(secretValues, params)))\n    .orderBy(asc(secretValues.key))\n    .limit(params.limit + 1);\n\n  const hasMore = rows.length > params.limit;\n  const pageRows = hasMore ? rows.slice(0, params.limit) : rows;\n  const last = pageRows.at(-1);\n\n  return {\n    secrets: pageRows.map(toSecretManagementRow),\n    nextCursor: hasMore && last ? last.key : null,\n  };\n}\n\nexport async function listVariableManagementRows(\n  params: ManagementListParams,\n  tx?: Tx,\n): Promise<VariableManagementListResult> {\n  const executor = tx ?? db();\n  // Preview = the value's first line, capped at the preview length. `valueTruncated`\n  // is true whenever the stored value differs from that preview (longer, or multi-line).\n  const valuePreview = sql<string>`left(split_part(${secretVariables.value}, chr(10), 1), ${VARIABLE_LIST_VALUE_PREVIEW_LENGTH})`;\n  const rows = await executor\n    .select({\n      id: secretVariables.id,\n      workspaceId: secretVariables.workspaceId,\n      projectId: secretVariables.projectId,\n      namespace: secretVariables.namespace,\n      key: secretVariables.key,\n      createdAt: secretVariables.createdAt,\n      updatedAt: secretVariables.updatedAt,\n      lastEditedBy: secretVariables.lastEditedBy,\n      valuePreview,\n      valueTruncated: sql<boolean>`${secretVariables.value} <> ${valuePreview}`,\n    })\n    .from(secretVariables)\n    .where(and(...managementFilters(secretVariables, params)))\n    .orderBy(asc(secretVariables.key))\n    .limit(params.limit + 1);\n\n  const hasMore = rows.length > params.limit;\n  const pageRows = hasMore ? rows.slice(0, params.limit) : rows;\n  const last = pageRows.at(-1);\n\n  return {\n    variables: pageRows.map((row) => ({\n      id: row.id,\n      workspaceId: row.workspaceId,\n      projectId: row.projectId,\n      namespace: row.namespace,\n      key: row.key,\n      value: row.valuePreview,\n      valueTruncated: row.valueTruncated,\n      createdAt: row.createdAt,\n      updatedAt: row.updatedAt,\n      lastEditedBy: row.lastEditedBy,\n    })),\n    nextCursor: hasMore && last ? last.key : null,\n  };\n}\n\nexport async function getSecretManagementRow(\n  params: StoreScope & {workspaceId: string; key: string},\n  tx?: Tx,\n): Promise<SecretManagementRow | undefined> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .select(secretManagementColumns)\n    .from(secretValues)\n    .where(and(...managementFilters(secretValues, params), eq(secretValues.key, params.key)))\n    .limit(1);\n\n  const row = rows[0];\n  return row ? toSecretManagementRow(row) : undefined;\n}\n\nexport async function getVariableManagementRow(\n  params: StoreScope & {workspaceId: string; key: string},\n  tx?: Tx,\n): Promise<SecretVariable | undefined> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .select()\n    .from(secretVariables)\n    .where(and(...managementFilters(secretVariables, params), eq(secretVariables.key, params.key)))\n    .limit(1);\n\n  const row = rows[0];\n  return row ? toSecretVariable(row) : undefined;\n}\n\nexport async function listExistingSecretManagementKeys(\n  params: StoreScope & {workspaceId: string; keys: string[]},\n  tx: Tx,\n): Promise<Set<string>> {\n  if (params.keys.length === 0) return new Set();\n\n  const rows = await tx\n    .select({key: secretValues.key})\n    .from(secretValues)\n    .where(and(...managementFilters(secretValues, params), inArray(secretValues.key, params.keys)));\n\n  return new Set(rows.map((row) => row.key));\n}\n\nexport async function listExistingVariableManagementKeys(\n  params: StoreScope & {workspaceId: string; keys: string[]},\n  tx: Tx,\n): Promise<Set<string>> {\n  if (params.keys.length === 0) return new Set();\n\n  const rows = await tx\n    .select({key: secretVariables.key})\n    .from(secretVariables)\n    .where(\n      and(...managementFilters(secretVariables, params), inArray(secretVariables.key, params.keys)),\n    );\n\n  return new Set(rows.map((row) => row.key));\n}\n\nexport async function deleteSecretManagementRows(\n  params: StoreScope & {workspaceId: string; keys: string[]},\n  tx: Tx,\n): Promise<SecretManagementRow[]> {\n  if (params.keys.length === 0) return [];\n\n  const rows = await tx\n    .delete(secretValues)\n    .where(and(...managementFilters(secretValues, params), inArray(secretValues.key, params.keys)))\n    .returning(secretManagementColumns);\n\n  return rows.map(toSecretManagementRow);\n}\n\nconst secretManagementColumns = {\n  id: secretValues.id,\n  workspaceId: secretValues.workspaceId,\n  projectId: secretValues.projectId,\n  namespace: secretValues.namespace,\n  key: secretValues.key,\n  createdAt: secretValues.createdAt,\n  updatedAt: secretValues.updatedAt,\n  lastEditedBy: secretValues.lastEditedBy,\n};\n\ntype SecretManagementDbRow =\n  typeof secretManagementColumns extends Record<string, infer _Column>\n    ? {\n        id: string;\n        workspaceId: string;\n        projectId: string | null;\n        namespace: string;\n        key: string;\n        createdAt: Date;\n        updatedAt: Date;\n        lastEditedBy: string | null;\n      }\n    : never;\n\nfunction toSecretManagementRow(row: SecretManagementDbRow): SecretManagementRow {\n  return {\n    id: row.id,\n    workspaceId: row.workspaceId,\n    projectId: row.projectId,\n    namespace: row.namespace,\n    key: row.key,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n    lastEditedBy: row.lastEditedBy,\n  };\n}\n\nexport async function deleteVariableManagementRows(\n  params: StoreScope & {workspaceId: string; keys: string[]},\n  tx: Tx,\n): Promise<SecretVariable[]> {\n  if (params.keys.length === 0) return [];\n\n  const rows = await tx\n    .delete(secretVariables)\n    .where(\n      and(...managementFilters(secretVariables, params), inArray(secretVariables.key, params.keys)),\n    )\n    .returning();\n\n  return rows.map(toSecretVariable);\n}\n\nfunction managementFilters(\n  table: {\n    workspaceId: AnyPgColumn;\n    projectId: AnyPgColumn;\n    namespace: AnyPgColumn;\n    key: AnyPgColumn;\n  },\n  params: StoreScope & {workspaceId: string; cursor?: string | undefined},\n): SQL[] {\n  const projectId = normalizedProjectId(params);\n  const filters = [\n    eq(table.workspaceId, params.workspaceId),\n    eq(table.namespace, ''),\n    projectId ? eq(table.projectId, projectId) : isNull(table.projectId),\n  ];\n  if (params.cursor) filters.push(gt(table.key, params.cursor));\n  return filters;\n}\n"],"names":["and","asc","eq","gt","inArray","isNull","sql","db","secretValues","secretVariables","toSecretVariable","normalizedProjectId","VARIABLE_LIST_VALUE_PREVIEW_LENGTH","listSecretManagementRows","params","tx","executor","rows","select","secretManagementColumns","from","where","managementFilters","orderBy","key","limit","hasMore","length","pageRows","slice","last","at","secrets","map","toSecretManagementRow","nextCursor","listVariableManagementRows","valuePreview","value","id","workspaceId","projectId","namespace","createdAt","updatedAt","lastEditedBy","valueTruncated","variables","row","getSecretManagementRow","undefined","getVariableManagementRow","listExistingSecretManagementKeys","keys","Set","listExistingVariableManagementKeys","deleteSecretManagementRows","delete","returning","deleteVariableManagementRows","table","filters","cursor","push"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAYC,GAAG,QAAO,cAAc;AAG7E,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAA0BC,YAAY,QAAO,qBAAqB;AAClE,SAA6BC,eAAe,EAAEC,gBAAgB,QAAO,wBAAwB;AAC7F,SAAQC,mBAAmB,QAAwB,aAAa;AAUhE,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,mEAAmE;AACnE,OAAO,MAAMC,qCAAqC,IAAI;AAiBtD,OAAO,eAAeC,yBACpBC,MAA4B,EAC5BC,EAAO;IAEP,MAAMC,WAAWD,MAAMR;IACvB,MAAMU,OAAO,MAAMD,SAChBE,MAAM,CAACC,yBACPC,IAAI,CAACZ,cACLa,KAAK,CAACrB,OAAOsB,kBAAkBd,cAAcM,UAC7CS,OAAO,CAACtB,IAAIO,aAAagB,GAAG,GAC5BC,KAAK,CAACX,OAAOW,KAAK,GAAG;IAExB,MAAMC,UAAUT,KAAKU,MAAM,GAAGb,OAAOW,KAAK;IAC1C,MAAMG,WAAWF,UAAUT,KAAKY,KAAK,CAAC,GAAGf,OAAOW,KAAK,IAAIR;IACzD,MAAMa,OAAOF,SAASG,EAAE,CAAC,CAAC;IAE1B,OAAO;QACLC,SAASJ,SAASK,GAAG,CAACC;QACtBC,YAAYT,WAAWI,OAAOA,KAAKN,GAAG,GAAG;IAC3C;AACF;AAEA,OAAO,eAAeY,2BACpBtB,MAA4B,EAC5BC,EAAO;IAEP,MAAMC,WAAWD,MAAMR;IACvB,mFAAmF;IACnF,uFAAuF;IACvF,MAAM8B,eAAe/B,GAAW,CAAC,gBAAgB,EAAEG,gBAAgB6B,KAAK,CAAC,eAAe,EAAE1B,mCAAmC,CAAC,CAAC;IAC/H,MAAMK,OAAO,MAAMD,SAChBE,MAAM,CAAC;QACNqB,IAAI9B,gBAAgB8B,EAAE;QACtBC,aAAa/B,gBAAgB+B,WAAW;QACxCC,WAAWhC,gBAAgBgC,SAAS;QACpCC,WAAWjC,gBAAgBiC,SAAS;QACpClB,KAAKf,gBAAgBe,GAAG;QACxBmB,WAAWlC,gBAAgBkC,SAAS;QACpCC,WAAWnC,gBAAgBmC,SAAS;QACpCC,cAAcpC,gBAAgBoC,YAAY;QAC1CR;QACAS,gBAAgBxC,GAAY,CAAC,EAAEG,gBAAgB6B,KAAK,CAAC,IAAI,EAAED,aAAa,CAAC;IAC3E,GACCjB,IAAI,CAACX,iBACLY,KAAK,CAACrB,OAAOsB,kBAAkBb,iBAAiBK,UAChDS,OAAO,CAACtB,IAAIQ,gBAAgBe,GAAG,GAC/BC,KAAK,CAACX,OAAOW,KAAK,GAAG;IAExB,MAAMC,UAAUT,KAAKU,MAAM,GAAGb,OAAOW,KAAK;IAC1C,MAAMG,WAAWF,UAAUT,KAAKY,KAAK,CAAC,GAAGf,OAAOW,KAAK,IAAIR;IACzD,MAAMa,OAAOF,SAASG,EAAE,CAAC,CAAC;IAE1B,OAAO;QACLgB,WAAWnB,SAASK,GAAG,CAAC,CAACe,MAAS,CAAA;gBAChCT,IAAIS,IAAIT,EAAE;gBACVC,aAAaQ,IAAIR,WAAW;gBAC5BC,WAAWO,IAAIP,SAAS;gBACxBC,WAAWM,IAAIN,SAAS;gBACxBlB,KAAKwB,IAAIxB,GAAG;gBACZc,OAAOU,IAAIX,YAAY;gBACvBS,gBAAgBE,IAAIF,cAAc;gBAClCH,WAAWK,IAAIL,SAAS;gBACxBC,WAAWI,IAAIJ,SAAS;gBACxBC,cAAcG,IAAIH,YAAY;YAChC,CAAA;QACAV,YAAYT,WAAWI,OAAOA,KAAKN,GAAG,GAAG;IAC3C;AACF;AAEA,OAAO,eAAeyB,uBACpBnC,MAAuD,EACvDC,EAAO;IAEP,MAAMC,WAAWD,MAAMR;IACvB,MAAMU,OAAO,MAAMD,SAChBE,MAAM,CAACC,yBACPC,IAAI,CAACZ,cACLa,KAAK,CAACrB,OAAOsB,kBAAkBd,cAAcM,SAASZ,GAAGM,aAAagB,GAAG,EAAEV,OAAOU,GAAG,IACrFC,KAAK,CAAC;IAET,MAAMuB,MAAM/B,IAAI,CAAC,EAAE;IACnB,OAAO+B,MAAMd,sBAAsBc,OAAOE;AAC5C;AAEA,OAAO,eAAeC,yBACpBrC,MAAuD,EACvDC,EAAO;IAEP,MAAMC,WAAWD,MAAMR;IACvB,MAAMU,OAAO,MAAMD,SAChBE,MAAM,GACNE,IAAI,CAACX,iBACLY,KAAK,CAACrB,OAAOsB,kBAAkBb,iBAAiBK,SAASZ,GAAGO,gBAAgBe,GAAG,EAAEV,OAAOU,GAAG,IAC3FC,KAAK,CAAC;IAET,MAAMuB,MAAM/B,IAAI,CAAC,EAAE;IACnB,OAAO+B,MAAMtC,iBAAiBsC,OAAOE;AACvC;AAEA,OAAO,eAAeE,iCACpBtC,MAA0D,EAC1DC,EAAM;IAEN,IAAID,OAAOuC,IAAI,CAAC1B,MAAM,KAAK,GAAG,OAAO,IAAI2B;IAEzC,MAAMrC,OAAO,MAAMF,GAChBG,MAAM,CAAC;QAACM,KAAKhB,aAAagB,GAAG;IAAA,GAC7BJ,IAAI,CAACZ,cACLa,KAAK,CAACrB,OAAOsB,kBAAkBd,cAAcM,SAASV,QAAQI,aAAagB,GAAG,EAAEV,OAAOuC,IAAI;IAE9F,OAAO,IAAIC,IAAIrC,KAAKgB,GAAG,CAAC,CAACe,MAAQA,IAAIxB,GAAG;AAC1C;AAEA,OAAO,eAAe+B,mCACpBzC,MAA0D,EAC1DC,EAAM;IAEN,IAAID,OAAOuC,IAAI,CAAC1B,MAAM,KAAK,GAAG,OAAO,IAAI2B;IAEzC,MAAMrC,OAAO,MAAMF,GAChBG,MAAM,CAAC;QAACM,KAAKf,gBAAgBe,GAAG;IAAA,GAChCJ,IAAI,CAACX,iBACLY,KAAK,CACJrB,OAAOsB,kBAAkBb,iBAAiBK,SAASV,QAAQK,gBAAgBe,GAAG,EAAEV,OAAOuC,IAAI;IAG/F,OAAO,IAAIC,IAAIrC,KAAKgB,GAAG,CAAC,CAACe,MAAQA,IAAIxB,GAAG;AAC1C;AAEA,OAAO,eAAegC,2BACpB1C,MAA0D,EAC1DC,EAAM;IAEN,IAAID,OAAOuC,IAAI,CAAC1B,MAAM,KAAK,GAAG,OAAO,EAAE;IAEvC,MAAMV,OAAO,MAAMF,GAChB0C,MAAM,CAACjD,cACPa,KAAK,CAACrB,OAAOsB,kBAAkBd,cAAcM,SAASV,QAAQI,aAAagB,GAAG,EAAEV,OAAOuC,IAAI,IAC3FK,SAAS,CAACvC;IAEb,OAAOF,KAAKgB,GAAG,CAACC;AAClB;AAEA,MAAMf,0BAA0B;IAC9BoB,IAAI/B,aAAa+B,EAAE;IACnBC,aAAahC,aAAagC,WAAW;IACrCC,WAAWjC,aAAaiC,SAAS;IACjCC,WAAWlC,aAAakC,SAAS;IACjClB,KAAKhB,aAAagB,GAAG;IACrBmB,WAAWnC,aAAamC,SAAS;IACjCC,WAAWpC,aAAaoC,SAAS;IACjCC,cAAcrC,aAAaqC,YAAY;AACzC;AAgBA,SAASX,sBAAsBc,GAA0B;IACvD,OAAO;QACLT,IAAIS,IAAIT,EAAE;QACVC,aAAaQ,IAAIR,WAAW;QAC5BC,WAAWO,IAAIP,SAAS;QACxBC,WAAWM,IAAIN,SAAS;QACxBlB,KAAKwB,IAAIxB,GAAG;QACZmB,WAAWK,IAAIL,SAAS;QACxBC,WAAWI,IAAIJ,SAAS;QACxBC,cAAcG,IAAIH,YAAY;IAChC;AACF;AAEA,OAAO,eAAec,6BACpB7C,MAA0D,EAC1DC,EAAM;IAEN,IAAID,OAAOuC,IAAI,CAAC1B,MAAM,KAAK,GAAG,OAAO,EAAE;IAEvC,MAAMV,OAAO,MAAMF,GAChB0C,MAAM,CAAChD,iBACPY,KAAK,CACJrB,OAAOsB,kBAAkBb,iBAAiBK,SAASV,QAAQK,gBAAgBe,GAAG,EAAEV,OAAOuC,IAAI,IAE5FK,SAAS;IAEZ,OAAOzC,KAAKgB,GAAG,CAACvB;AAClB;AAEA,SAASY,kBACPsC,KAKC,EACD9C,MAAuE;IAEvE,MAAM2B,YAAY9B,oBAAoBG;IACtC,MAAM+C,UAAU;QACd3D,GAAG0D,MAAMpB,WAAW,EAAE1B,OAAO0B,WAAW;QACxCtC,GAAG0D,MAAMlB,SAAS,EAAE;QACpBD,YAAYvC,GAAG0D,MAAMnB,SAAS,EAAEA,aAAapC,OAAOuD,MAAMnB,SAAS;KACpE;IACD,IAAI3B,OAAOgD,MAAM,EAAED,QAAQE,IAAI,CAAC5D,GAAGyD,MAAMpC,GAAG,EAAEV,OAAOgD,MAAM;IAC3D,OAAOD;AACT"}

package/dist/db/schema/common.d.ts

@@ -0,0 +1,3 @@
+export declare const pgTable: import("drizzle-orm/pg-core").PgTableFn<undefined>;
+export declare function sqlStringLiteral(value: string): import("drizzle-orm").SQL<unknown>;
+//# sourceMappingURL=common.d.ts.map

package/dist/db/schema/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/db/schema/common.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,oDAA8C,CAAC;AAEnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,sCAE7C"}

package/dist/db/schema/common.js

@@ -0,0 +1,8 @@
+import { sql } from 'drizzle-orm';
+import { pgTableCreator } from 'drizzle-orm/pg-core';
+export const pgTable = pgTableCreator((name)=>`secrets_${name}`);
+export function sqlStringLiteral(value) {
+    return sql.raw(`'${value.replaceAll("'", "''")}'`);
+}
+
+//# sourceMappingURL=common.js.map

package/dist/db/schema/common.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/common.ts"],"sourcesContent":["import {sql} from 'drizzle-orm';\nimport {pgTableCreator} from 'drizzle-orm/pg-core';\n\nexport const pgTable = pgTableCreator((name) => `secrets_${name}`);\n\nexport function sqlStringLiteral(value: string) {\n  return sql.raw(`'${value.replaceAll(\"'\", \"''\")}'`);\n}\n"],"names":["sql","pgTableCreator","pgTable","name","sqlStringLiteral","value","raw","replaceAll"],"mappings":"AAAA,SAAQA,GAAG,QAAO,cAAc;AAChC,SAAQC,cAAc,QAAO,sBAAsB;AAEnD,OAAO,MAAMC,UAAUD,eAAe,CAACE,OAAS,CAAC,QAAQ,EAAEA,MAAM,EAAE;AAEnE,OAAO,SAASC,iBAAiBC,KAAa;IAC5C,OAAOL,IAAIM,GAAG,CAAC,CAAC,CAAC,EAAED,MAAME,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC;AACnD"}

package/dist/db/schema/data-keys.d.ts

@@ -0,0 +1,103 @@
+export interface DataKey {
+    workspaceId: string;
+    wrappedDek: string;
+    kekVersion: string;
+    createdAt: Date;
+    rotatedAt: Date | null;
+}
+export declare const secretDataKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "data_keys";
+    schema: undefined;
+    columns: {
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "data_keys";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
+            name: "wrapped_dek";
+            tableName: "data_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kekVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kek_version";
+            tableName: "data_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "data_keys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotated_at";
+            tableName: "data_keys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type DataKeyDb = typeof secretDataKeys.$inferSelect;
+export type DataKeyCreateDb = typeof secretDataKeys.$inferInsert;
+export declare function toDataKey(row: DataKeyDb): DataKey;
+//# sourceMappingURL=data-keys.d.ts.map

package/dist/db/schema/data-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-keys.d.ts","sourceRoot":"","sources":["../../../src/db/schema/data-keys.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMzB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAEjE,wBAAgB,SAAS,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAQjD"}

package/dist/db/schema/data-keys.js

@@ -0,0 +1,24 @@
+import { text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { pgTable } from './common.js';
+export const secretDataKeys = pgTable('data_keys', {
+    workspaceId: uuid('workspace_id').primaryKey(),
+    wrappedDek: text('wrapped_dek').notNull(),
+    kekVersion: text('kek_version').notNull(),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    rotatedAt: timestamp('rotated_at', {
+        withTimezone: true
+    })
+});
+export function toDataKey(row) {
+    return {
+        workspaceId: row.workspaceId,
+        wrappedDek: row.wrappedDek,
+        kekVersion: row.kekVersion,
+        createdAt: row.createdAt,
+        rotatedAt: row.rotatedAt
+    };
+}
+
+//# sourceMappingURL=data-keys.js.map

package/dist/db/schema/data-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/data-keys.ts"],"sourcesContent":["import {text, timestamp, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable} from './common.js';\n\nexport interface DataKey {\n  workspaceId: string;\n  wrappedDek: string;\n  kekVersion: string;\n  createdAt: Date;\n  rotatedAt: Date | null;\n}\n\nexport const secretDataKeys = pgTable('data_keys', {\n  workspaceId: uuid('workspace_id').primaryKey(),\n  wrappedDek: text('wrapped_dek').notNull(),\n  kekVersion: text('kek_version').notNull(),\n  createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n  rotatedAt: timestamp('rotated_at', {withTimezone: true}),\n});\n\nexport type DataKeyDb = typeof secretDataKeys.$inferSelect;\nexport type DataKeyCreateDb = typeof secretDataKeys.$inferInsert;\n\nexport function toDataKey(row: DataKeyDb): DataKey {\n  return {\n    workspaceId: row.workspaceId,\n    wrappedDek: row.wrappedDek,\n    kekVersion: row.kekVersion,\n    createdAt: row.createdAt,\n    rotatedAt: row.rotatedAt,\n  };\n}\n"],"names":["text","timestamp","uuid","pgTable","secretDataKeys","workspaceId","primaryKey","wrappedDek","notNull","kekVersion","createdAt","withTimezone","defaultNow","rotatedAt","toDataKey","row"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,SAAS,EAAEC,IAAI,QAAO,sBAAsB;AAC1D,SAAQC,OAAO,QAAO,cAAc;AAUpC,OAAO,MAAMC,iBAAiBD,QAAQ,aAAa;IACjDE,aAAaH,KAAK,gBAAgBI,UAAU;IAC5CC,YAAYP,KAAK,eAAeQ,OAAO;IACvCC,YAAYT,KAAK,eAAeQ,OAAO;IACvCE,WAAWT,UAAU,cAAc;QAACU,cAAc;IAAI,GAAGH,OAAO,GAAGI,UAAU;IAC7EC,WAAWZ,UAAU,cAAc;QAACU,cAAc;IAAI;AACxD,GAAG;AAKH,OAAO,SAASG,UAAUC,GAAc;IACtC,OAAO;QACLV,aAAaU,IAAIV,WAAW;QAC5BE,YAAYQ,IAAIR,UAAU;QAC1BE,YAAYM,IAAIN,UAAU;QAC1BC,WAAWK,IAAIL,SAAS;QACxBG,WAAWE,IAAIF,SAAS;IAC1B;AACF"}