@shipfox/api-secrets 2.0.0

package/dist/db/schema/variables.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/variables.ts"],"sourcesContent":["import {NAMESPACE_PATTERN_SOURCE, SECRET_KEY_PATTERN_SOURCE} from '@shipfox/api-secrets-dto';\nimport {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {check, index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable, sqlStringLiteral} from './common.js';\n\nexport interface SecretVariable {\n  id: string;\n  workspaceId: string;\n  projectId: string | null;\n  namespace: string;\n  key: string;\n  value: string;\n  createdAt: Date;\n  updatedAt: Date;\n  lastEditedBy: string | null;\n}\n\nexport const secretVariables = pgTable(\n  'variables',\n  {\n    id: uuidv7PrimaryKey(),\n    workspaceId: uuid('workspace_id').notNull(),\n    projectId: uuid('project_id'),\n    namespace: text('namespace').notNull(),\n    key: text('key').notNull(),\n    value: text('value').notNull(),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n    lastEditedBy: uuid('last_edited_by'),\n  },\n  (table) => [\n    uniqueIndex('secrets_variables_ws_scope_unique')\n      .on(table.workspaceId, table.namespace, table.key)\n      .where(sql`\"project_id\" IS NULL`),\n    uniqueIndex('secrets_variables_project_scope_unique')\n      .on(table.workspaceId, table.projectId, table.namespace, table.key)\n      .where(sql`\"project_id\" IS NOT NULL`),\n    index('secrets_variables_lookup_idx').on(\n      table.workspaceId,\n      table.namespace,\n      table.projectId,\n      table.key,\n    ),\n    check(\n      'secrets_variables_key_ck',\n      sql`${table.key} ~ ${sqlStringLiteral(SECRET_KEY_PATTERN_SOURCE)}`,\n    ),\n    check(\n      'secrets_variables_namespace_ck',\n      sql`char_length(${table.namespace}) <= 128 AND (${table.namespace} = '' OR ${table.namespace} ~ ${sqlStringLiteral(NAMESPACE_PATTERN_SOURCE)})`,\n    ),\n  ],\n);\n\nexport type SecretVariableDb = typeof secretVariables.$inferSelect;\nexport type SecretVariableCreateDb = typeof secretVariables.$inferInsert;\n\nexport function toSecretVariable(row: SecretVariableDb): SecretVariable {\n  return {\n    id: row.id,\n    workspaceId: row.workspaceId,\n    projectId: row.projectId,\n    namespace: row.namespace,\n    key: row.key,\n    value: row.value,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n    lastEditedBy: row.lastEditedBy,\n  };\n}\n"],"names":["NAMESPACE_PATTERN_SOURCE","SECRET_KEY_PATTERN_SOURCE","uuidv7PrimaryKey","sql","check","index","text","timestamp","uniqueIndex","uuid","pgTable","sqlStringLiteral","secretVariables","id","workspaceId","notNull","projectId","namespace","key","value","createdAt","withTimezone","defaultNow","updatedAt","lastEditedBy","table","on","where","toSecretVariable","row"],"mappings":"AAAA,SAAQA,wBAAwB,EAAEC,yBAAyB,QAAO,2BAA2B;AAC7F,SAAQC,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AACrF,SAAQC,OAAO,EAAEC,gBAAgB,QAAO,cAAc;AActD,OAAO,MAAMC,kBAAkBF,QAC7B,aACA;IACEG,IAAIX;IACJY,aAAaL,KAAK,gBAAgBM,OAAO;IACzCC,WAAWP,KAAK;IAChBQ,WAAWX,KAAK,aAAaS,OAAO;IACpCG,KAAKZ,KAAK,OAAOS,OAAO;IACxBI,OAAOb,KAAK,SAASS,OAAO;IAC5BK,WAAWb,UAAU,cAAc;QAACc,cAAc;IAAI,GAAGN,OAAO,GAAGO,UAAU;IAC7EC,WAAWhB,UAAU,cAAc;QAACc,cAAc;IAAI,GAAGN,OAAO,GAAGO,UAAU;IAC7EE,cAAcf,KAAK;AACrB,GACA,CAACgB,QAAU;QACTjB,YAAY,qCACTkB,EAAE,CAACD,MAAMX,WAAW,EAAEW,MAAMR,SAAS,EAAEQ,MAAMP,GAAG,EAChDS,KAAK,CAACxB,GAAG,CAAC,oBAAoB,CAAC;QAClCK,YAAY,0CACTkB,EAAE,CAACD,MAAMX,WAAW,EAAEW,MAAMT,SAAS,EAAES,MAAMR,SAAS,EAAEQ,MAAMP,GAAG,EACjES,KAAK,CAACxB,GAAG,CAAC,wBAAwB,CAAC;QACtCE,MAAM,gCAAgCqB,EAAE,CACtCD,MAAMX,WAAW,EACjBW,MAAMR,SAAS,EACfQ,MAAMT,SAAS,EACfS,MAAMP,GAAG;QAEXd,MACE,4BACAD,GAAG,CAAC,EAAEsB,MAAMP,GAAG,CAAC,GAAG,EAAEP,iBAAiBV,2BAA2B,CAAC;QAEpEG,MACE,kCACAD,GAAG,CAAC,YAAY,EAAEsB,MAAMR,SAAS,CAAC,cAAc,EAAEQ,MAAMR,SAAS,CAAC,SAAS,EAAEQ,MAAMR,SAAS,CAAC,GAAG,EAAEN,iBAAiBX,0BAA0B,CAAC,CAAC;KAElJ,EACD;AAKF,OAAO,SAAS4B,iBAAiBC,GAAqB;IACpD,OAAO;QACLhB,IAAIgB,IAAIhB,EAAE;QACVC,aAAae,IAAIf,WAAW;QAC5BE,WAAWa,IAAIb,SAAS;QACxBC,WAAWY,IAAIZ,SAAS;QACxBC,KAAKW,IAAIX,GAAG;QACZC,OAAOU,IAAIV,KAAK;QAChBC,WAAWS,IAAIT,SAAS;QACxBG,WAAWM,IAAIN,SAAS;QACxBC,cAAcK,IAAIL,YAAY;IAChC;AACF"}

package/dist/db/scope.d.ts

@@ -0,0 +1,20 @@
+import { type SQL } from 'drizzle-orm';
+import type { PgColumn } from 'drizzle-orm/pg-core';
+export interface StoreScope {
+    projectId?: string | null | undefined;
+}
+export interface ScopeColumns {
+    workspaceId: PgColumn;
+    projectId: PgColumn;
+    namespace: PgColumn;
+    key: PgColumn;
+}
+export declare function normalizedProjectId(scope?: StoreScope | undefined): string | null;
+export declare function scopeConflictTargetWhere(scope?: StoreScope | undefined): SQL;
+export declare function scopeExactWhere(columns: ScopeColumns, params: StoreScope): SQL | undefined;
+export declare function lookupWithPrecedenceWhere(columns: ScopeColumns, params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    key: string;
+}): SQL | undefined;
+//# sourceMappingURL=scope.d.ts.map

package/dist/db/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/db/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,GAAG,EAAM,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,qBAAqB,CAAC;AAElD,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,QAAQ,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAEjF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,GAAG,CAI5E;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,GAAG,GAAG,SAAS,CAG1F;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,GACzE,GAAG,GAAG,SAAS,CASjB"}

package/dist/db/scope.js

@@ -0,0 +1,19 @@
+import { and, eq, isNull, or, sql } from 'drizzle-orm';
+export function normalizedProjectId(scope) {
+    return scope?.projectId || null;
+}
+export function scopeConflictTargetWhere(scope) {
+    return normalizedProjectId(scope) !== null ? sql`"project_id" IS NOT NULL` : sql`"project_id" IS NULL`;
+}
+export function scopeExactWhere(columns, params) {
+    const projectId = normalizedProjectId(params);
+    return projectId !== null ? eq(columns.projectId, projectId) : isNull(columns.projectId);
+}
+export function lookupWithPrecedenceWhere(columns, params) {
+    const base = and(eq(columns.workspaceId, params.workspaceId), eq(columns.namespace, params.namespace), eq(columns.key, params.key));
+    const projectId = normalizedProjectId(params);
+    if (projectId === null) return and(base, isNull(columns.projectId));
+    return and(base, or(eq(columns.projectId, projectId), isNull(columns.projectId)));
+}
+
+//# sourceMappingURL=scope.js.map

package/dist/db/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/scope.ts"],"sourcesContent":["import {and, eq, isNull, or, type SQL, sql} from 'drizzle-orm';\nimport type {PgColumn} from 'drizzle-orm/pg-core';\n\nexport interface StoreScope {\n  projectId?: string | null | undefined;\n}\n\nexport interface ScopeColumns {\n  workspaceId: PgColumn;\n  projectId: PgColumn;\n  namespace: PgColumn;\n  key: PgColumn;\n}\n\nexport function normalizedProjectId(scope?: StoreScope | undefined): string | null {\n  return scope?.projectId || null;\n}\n\nexport function scopeConflictTargetWhere(scope?: StoreScope | undefined): SQL {\n  return normalizedProjectId(scope) !== null\n    ? sql`\"project_id\" IS NOT NULL`\n    : sql`\"project_id\" IS NULL`;\n}\n\nexport function scopeExactWhere(columns: ScopeColumns, params: StoreScope): SQL | undefined {\n  const projectId = normalizedProjectId(params);\n  return projectId !== null ? eq(columns.projectId, projectId) : isNull(columns.projectId);\n}\n\nexport function lookupWithPrecedenceWhere(\n  columns: ScopeColumns,\n  params: StoreScope & {workspaceId: string; namespace: string; key: string},\n): SQL | undefined {\n  const base = and(\n    eq(columns.workspaceId, params.workspaceId),\n    eq(columns.namespace, params.namespace),\n    eq(columns.key, params.key),\n  );\n  const projectId = normalizedProjectId(params);\n  if (projectId === null) return and(base, isNull(columns.projectId));\n  return and(base, or(eq(columns.projectId, projectId), isNull(columns.projectId)));\n}\n"],"names":["and","eq","isNull","or","sql","normalizedProjectId","scope","projectId","scopeConflictTargetWhere","scopeExactWhere","columns","params","lookupWithPrecedenceWhere","base","workspaceId","namespace","key"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAYC,GAAG,QAAO,cAAc;AAc/D,OAAO,SAASC,oBAAoBC,KAA8B;IAChE,OAAOA,OAAOC,aAAa;AAC7B;AAEA,OAAO,SAASC,yBAAyBF,KAA8B;IACrE,OAAOD,oBAAoBC,WAAW,OAClCF,GAAG,CAAC,wBAAwB,CAAC,GAC7BA,GAAG,CAAC,oBAAoB,CAAC;AAC/B;AAEA,OAAO,SAASK,gBAAgBC,OAAqB,EAAEC,MAAkB;IACvE,MAAMJ,YAAYF,oBAAoBM;IACtC,OAAOJ,cAAc,OAAON,GAAGS,QAAQH,SAAS,EAAEA,aAAaL,OAAOQ,QAAQH,SAAS;AACzF;AAEA,OAAO,SAASK,0BACdF,OAAqB,EACrBC,MAA0E;IAE1E,MAAME,OAAOb,IACXC,GAAGS,QAAQI,WAAW,EAAEH,OAAOG,WAAW,GAC1Cb,GAAGS,QAAQK,SAAS,EAAEJ,OAAOI,SAAS,GACtCd,GAAGS,QAAQM,GAAG,EAAEL,OAAOK,GAAG;IAE5B,MAAMT,YAAYF,oBAAoBM;IACtC,IAAIJ,cAAc,MAAM,OAAOP,IAAIa,MAAMX,OAAOQ,QAAQH,SAAS;IACjE,OAAOP,IAAIa,MAAMV,GAAGF,GAAGS,QAAQH,SAAS,EAAEA,YAAYL,OAAOQ,QAAQH,SAAS;AAChF"}

package/dist/db/values.d.ts

@@ -0,0 +1,33 @@
+import { type Tx } from './db.js';
+import { type SecretValue } from './schema/values.js';
+import { type StoreScope } from './scope.js';
+export interface SecretValueWrite {
+    workspaceId: string;
+    projectId: string | null;
+    namespace: string;
+    key: string;
+    ciphertext: string;
+    fingerprint: string | null;
+    lastEditedBy?: string | null | undefined;
+}
+export declare function getSecretValueRowWithPrecedence(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    key: string;
+}, tx?: Tx): Promise<SecretValue | undefined>;
+export declare function listSecretValueRowsByNamespace(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+}, tx?: Tx): Promise<SecretValue[]>;
+export declare function upsertSecretValueRows(rows: SecretValueWrite[], tx: Tx): Promise<void>;
+export declare function countSecretValueRows(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    keys: string[];
+}, tx: Tx): Promise<number>;
+export declare function deleteSecretValueRows(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    keys?: string[] | undefined;
+}, tx?: Tx): Promise<number>;
+//# sourceMappingURL=values.d.ts.map

package/dist/db/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/db/values.ts"],"names":[],"mappings":"AAEA,OAAO,EAAK,KAAK,EAAE,EAAC,MAAM,SAAS,CAAC;AACpC,OAAO,EAAC,KAAK,WAAW,EAA8B,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,EAC1E,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAoBlC;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,EAC7D,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,WAAW,EAAE,CAAC,CAWxB;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3F;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAC7E,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAAC,EAC1F,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/db/values.js

@@ -0,0 +1,119 @@
+import { and, eq, inArray, isNull, sql } from 'drizzle-orm';
+import { SecretBatchScopeMismatchError } from '#core/errors.js';
+import { db } from './db.js';
+import { secretValues, toSecretValue } from './schema/values.js';
+import { lookupWithPrecedenceWhere, normalizedProjectId, scopeConflictTargetWhere, scopeExactWhere } from './scope.js';
+export async function getSecretValueRowWithPrecedence(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.select().from(secretValues).where(lookupWithPrecedenceWhere({
+        workspaceId: secretValues.workspaceId,
+        projectId: secretValues.projectId,
+        namespace: secretValues.namespace,
+        key: secretValues.key
+    }, params)).orderBy(sql`${secretValues.projectId} NULLS LAST`).limit(1);
+    const row = rows[0];
+    return row ? toSecretValue(row) : undefined;
+}
+export async function listSecretValueRowsByNamespace(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.execute(sql`
+    SELECT DISTINCT ON (key)
+      id, workspace_id, project_id, namespace, key, ciphertext, fingerprint,
+      created_at, updated_at, last_edited_by
+    FROM secrets_values
+    WHERE ${listByNamespaceSql(params)}
+    ORDER BY key, project_id NULLS LAST, id
+  `);
+    return rows.rows.map(rowToSecretValue);
+}
+export async function upsertSecretValueRows(rows, tx) {
+    if (rows.length === 0) return;
+    const projectId = batchProjectId(rows);
+    await tx.insert(secretValues).values(rows).onConflictDoUpdate({
+        target: projectId ? [
+            secretValues.workspaceId,
+            secretValues.projectId,
+            secretValues.namespace,
+            secretValues.key
+        ] : [
+            secretValues.workspaceId,
+            secretValues.namespace,
+            secretValues.key
+        ],
+        targetWhere: scopeConflictTargetWhere({
+            projectId
+        }),
+        set: {
+            ciphertext: sql`excluded.ciphertext`,
+            fingerprint: sql`excluded.fingerprint`,
+            lastEditedBy: sql`excluded.last_edited_by`,
+            updatedAt: sql`NOW()`
+        }
+    });
+}
+export async function countSecretValueRows(params, tx) {
+    if (params.keys.length === 0) return 0;
+    const rows = await tx.select({
+        count: sql`COUNT(*)`
+    }).from(secretValues).where(and(eq(secretValues.workspaceId, params.workspaceId), eq(secretValues.namespace, params.namespace), scopeExactWhere({
+        workspaceId: secretValues.workspaceId,
+        projectId: secretValues.projectId,
+        namespace: secretValues.namespace,
+        key: secretValues.key
+    }, params) ?? isNull(secretValues.projectId), inArray(secretValues.key, params.keys)));
+    return Number(rows[0]?.count ?? 0);
+}
+export async function deleteSecretValueRows(params, tx) {
+    if (params.keys && params.keys.length === 0) return 0;
+    const executor = tx ?? db();
+    const filters = [
+        eq(secretValues.workspaceId, params.workspaceId),
+        eq(secretValues.namespace, params.namespace),
+        scopeExactWhere({
+            workspaceId: secretValues.workspaceId,
+            projectId: secretValues.projectId,
+            namespace: secretValues.namespace,
+            key: secretValues.key
+        }, params) ?? isNull(secretValues.projectId)
+    ];
+    if (params.keys && params.keys.length > 0) {
+        filters.push(inArray(secretValues.key, params.keys));
+    }
+    const deleted = await executor.delete(secretValues).where(and(...filters)).returning({
+        id: secretValues.id
+    });
+    return deleted.length;
+}
+function batchProjectId(rows) {
+    const projectId = normalizedProjectId({
+        projectId: rows[0]?.projectId
+    });
+    const mixedScope = rows.some((row)=>normalizedProjectId({
+            projectId: row.projectId
+        }) !== projectId);
+    if (mixedScope) throw new SecretBatchScopeMismatchError();
+    return projectId;
+}
+function listByNamespaceSql(params) {
+    const projectId = normalizedProjectId(params);
+    if (!projectId) {
+        return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND project_id IS NULL`;
+    }
+    return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND (project_id = ${projectId} OR project_id IS NULL)`;
+}
+function rowToSecretValue(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        projectId: row.project_id,
+        namespace: row.namespace,
+        key: row.key,
+        ciphertext: row.ciphertext,
+        fingerprint: row.fingerprint,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        lastEditedBy: row.last_edited_by
+    };
+}
+
+//# sourceMappingURL=values.js.map

package/dist/db/values.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/values.ts"],"sourcesContent":["import {and, eq, inArray, isNull, sql} from 'drizzle-orm';\nimport {SecretBatchScopeMismatchError} from '#core/errors.js';\nimport {db, type Tx} from './db.js';\nimport {type SecretValue, secretValues, toSecretValue} from './schema/values.js';\nimport {\n  lookupWithPrecedenceWhere,\n  normalizedProjectId,\n  type StoreScope,\n  scopeConflictTargetWhere,\n  scopeExactWhere,\n} from './scope.js';\n\nexport interface SecretValueWrite {\n  workspaceId: string;\n  projectId: string | null;\n  namespace: string;\n  key: string;\n  ciphertext: string;\n  fingerprint: string | null;\n  lastEditedBy?: string | null | undefined;\n}\n\nexport async function getSecretValueRowWithPrecedence(\n  params: StoreScope & {workspaceId: string; namespace: string; key: string},\n  tx?: Tx,\n): Promise<SecretValue | undefined> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .select()\n    .from(secretValues)\n    .where(\n      lookupWithPrecedenceWhere(\n        {\n          workspaceId: secretValues.workspaceId,\n          projectId: secretValues.projectId,\n          namespace: secretValues.namespace,\n          key: secretValues.key,\n        },\n        params,\n      ),\n    )\n    .orderBy(sql`${secretValues.projectId} NULLS LAST`)\n    .limit(1);\n  const row = rows[0];\n  return row ? toSecretValue(row) : undefined;\n}\n\nexport async function listSecretValueRowsByNamespace(\n  params: StoreScope & {workspaceId: string; namespace: string},\n  tx?: Tx,\n): Promise<SecretValue[]> {\n  const executor = tx ?? db();\n  const rows = await executor.execute<SecretValueRow>(sql`\n    SELECT DISTINCT ON (key)\n      id, workspace_id, project_id, namespace, key, ciphertext, fingerprint,\n      created_at, updated_at, last_edited_by\n    FROM secrets_values\n    WHERE ${listByNamespaceSql(params)}\n    ORDER BY key, project_id NULLS LAST, id\n  `);\n  return rows.rows.map(rowToSecretValue);\n}\n\nexport async function upsertSecretValueRows(rows: SecretValueWrite[], tx: Tx): Promise<void> {\n  if (rows.length === 0) return;\n  const projectId = batchProjectId(rows);\n  await tx\n    .insert(secretValues)\n    .values(rows)\n    .onConflictDoUpdate({\n      target: projectId\n        ? [\n            secretValues.workspaceId,\n            secretValues.projectId,\n            secretValues.namespace,\n            secretValues.key,\n          ]\n        : [secretValues.workspaceId, secretValues.namespace, secretValues.key],\n      targetWhere: scopeConflictTargetWhere({projectId}),\n      set: {\n        ciphertext: sql`excluded.ciphertext`,\n        fingerprint: sql`excluded.fingerprint`,\n        lastEditedBy: sql`excluded.last_edited_by`,\n        updatedAt: sql`NOW()`,\n      },\n    });\n}\n\nexport async function countSecretValueRows(\n  params: StoreScope & {workspaceId: string; namespace: string; keys: string[]},\n  tx: Tx,\n): Promise<number> {\n  if (params.keys.length === 0) return 0;\n\n  const rows = await tx\n    .select({count: sql<string | number>`COUNT(*)`})\n    .from(secretValues)\n    .where(\n      and(\n        eq(secretValues.workspaceId, params.workspaceId),\n        eq(secretValues.namespace, params.namespace),\n        scopeExactWhere(\n          {\n            workspaceId: secretValues.workspaceId,\n            projectId: secretValues.projectId,\n            namespace: secretValues.namespace,\n            key: secretValues.key,\n          },\n          params,\n        ) ?? isNull(secretValues.projectId),\n        inArray(secretValues.key, params.keys),\n      ),\n    );\n\n  return Number(rows[0]?.count ?? 0);\n}\n\nexport async function deleteSecretValueRows(\n  params: StoreScope & {workspaceId: string; namespace: string; keys?: string[] | undefined},\n  tx?: Tx,\n): Promise<number> {\n  if (params.keys && params.keys.length === 0) return 0;\n\n  const executor = tx ?? db();\n  const filters = [\n    eq(secretValues.workspaceId, params.workspaceId),\n    eq(secretValues.namespace, params.namespace),\n    scopeExactWhere(\n      {\n        workspaceId: secretValues.workspaceId,\n        projectId: secretValues.projectId,\n        namespace: secretValues.namespace,\n        key: secretValues.key,\n      },\n      params,\n    ) ?? isNull(secretValues.projectId),\n  ];\n  if (params.keys && params.keys.length > 0) {\n    filters.push(inArray(secretValues.key, params.keys));\n  }\n  const deleted = await executor\n    .delete(secretValues)\n    .where(and(...filters))\n    .returning({id: secretValues.id});\n  return deleted.length;\n}\n\nfunction batchProjectId(rows: SecretValueWrite[]): string | null {\n  const projectId = normalizedProjectId({projectId: rows[0]?.projectId});\n  const mixedScope = rows.some(\n    (row) => normalizedProjectId({projectId: row.projectId}) !== projectId,\n  );\n  if (mixedScope) throw new SecretBatchScopeMismatchError();\n  return projectId;\n}\n\nfunction listByNamespaceSql(params: StoreScope & {workspaceId: string; namespace: string}) {\n  const projectId = normalizedProjectId(params);\n  if (!projectId) {\n    return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND project_id IS NULL`;\n  }\n  return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND (project_id = ${projectId} OR project_id IS NULL)`;\n}\n\ninterface SecretValueRow extends Record<string, unknown> {\n  id: string;\n  workspace_id: string;\n  project_id: string | null;\n  namespace: string;\n  key: string;\n  ciphertext: string;\n  fingerprint: string | null;\n  created_at: Date;\n  updated_at: Date;\n  last_edited_by: string | null;\n}\n\nfunction rowToSecretValue(row: SecretValueRow): SecretValue {\n  return {\n    id: row.id,\n    workspaceId: row.workspace_id,\n    projectId: row.project_id,\n    namespace: row.namespace,\n    key: row.key,\n    ciphertext: row.ciphertext,\n    fingerprint: row.fingerprint,\n    createdAt: row.created_at,\n    updatedAt: row.updated_at,\n    lastEditedBy: row.last_edited_by,\n  };\n}\n"],"names":["and","eq","inArray","isNull","sql","SecretBatchScopeMismatchError","db","secretValues","toSecretValue","lookupWithPrecedenceWhere","normalizedProjectId","scopeConflictTargetWhere","scopeExactWhere","getSecretValueRowWithPrecedence","params","tx","executor","rows","select","from","where","workspaceId","projectId","namespace","key","orderBy","limit","row","undefined","listSecretValueRowsByNamespace","execute","listByNamespaceSql","map","rowToSecretValue","upsertSecretValueRows","length","batchProjectId","insert","values","onConflictDoUpdate","target","targetWhere","set","ciphertext","fingerprint","lastEditedBy","updatedAt","countSecretValueRows","keys","count","Number","deleteSecretValueRows","filters","push","deleted","delete","returning","id","mixedScope","some","workspace_id","project_id","createdAt","created_at","updated_at","last_edited_by"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AAC1D,SAAQC,6BAA6B,QAAO,kBAAkB;AAC9D,SAAQC,EAAE,QAAgB,UAAU;AACpC,SAA0BC,YAAY,EAAEC,aAAa,QAAO,qBAAqB;AACjF,SACEC,yBAAyB,EACzBC,mBAAmB,EAEnBC,wBAAwB,EACxBC,eAAe,QACV,aAAa;AAYpB,OAAO,eAAeC,gCACpBC,MAA0E,EAC1EC,EAAO;IAEP,MAAMC,WAAWD,MAAMT;IACvB,MAAMW,OAAO,MAAMD,SAChBE,MAAM,GACNC,IAAI,CAACZ,cACLa,KAAK,CACJX,0BACE;QACEY,aAAad,aAAac,WAAW;QACrCC,WAAWf,aAAae,SAAS;QACjCC,WAAWhB,aAAagB,SAAS;QACjCC,KAAKjB,aAAaiB,GAAG;IACvB,GACAV,SAGHW,OAAO,CAACrB,GAAG,CAAC,EAAEG,aAAae,SAAS,CAAC,WAAW,CAAC,EACjDI,KAAK,CAAC;IACT,MAAMC,MAAMV,IAAI,CAAC,EAAE;IACnB,OAAOU,MAAMnB,cAAcmB,OAAOC;AACpC;AAEA,OAAO,eAAeC,+BACpBf,MAA6D,EAC7DC,EAAO;IAEP,MAAMC,WAAWD,MAAMT;IACvB,MAAMW,OAAO,MAAMD,SAASc,OAAO,CAAiB1B,GAAG,CAAC;;;;;UAKhD,EAAE2B,mBAAmBjB,QAAQ;;EAErC,CAAC;IACD,OAAOG,KAAKA,IAAI,CAACe,GAAG,CAACC;AACvB;AAEA,OAAO,eAAeC,sBAAsBjB,IAAwB,EAAEF,EAAM;IAC1E,IAAIE,KAAKkB,MAAM,KAAK,GAAG;IACvB,MAAMb,YAAYc,eAAenB;IACjC,MAAMF,GACHsB,MAAM,CAAC9B,cACP+B,MAAM,CAACrB,MACPsB,kBAAkB,CAAC;QAClBC,QAAQlB,YACJ;YACEf,aAAac,WAAW;YACxBd,aAAae,SAAS;YACtBf,aAAagB,SAAS;YACtBhB,aAAaiB,GAAG;SACjB,GACD;YAACjB,aAAac,WAAW;YAAEd,aAAagB,SAAS;YAAEhB,aAAaiB,GAAG;SAAC;QACxEiB,aAAa9B,yBAAyB;YAACW;QAAS;QAChDoB,KAAK;YACHC,YAAYvC,GAAG,CAAC,mBAAmB,CAAC;YACpCwC,aAAaxC,GAAG,CAAC,oBAAoB,CAAC;YACtCyC,cAAczC,GAAG,CAAC,uBAAuB,CAAC;YAC1C0C,WAAW1C,GAAG,CAAC,KAAK,CAAC;QACvB;IACF;AACJ;AAEA,OAAO,eAAe2C,qBACpBjC,MAA6E,EAC7EC,EAAM;IAEN,IAAID,OAAOkC,IAAI,CAACb,MAAM,KAAK,GAAG,OAAO;IAErC,MAAMlB,OAAO,MAAMF,GAChBG,MAAM,CAAC;QAAC+B,OAAO7C,GAAoB,CAAC,QAAQ,CAAC;IAAA,GAC7Ce,IAAI,CAACZ,cACLa,KAAK,CACJpB,IACEC,GAAGM,aAAac,WAAW,EAAEP,OAAOO,WAAW,GAC/CpB,GAAGM,aAAagB,SAAS,EAAET,OAAOS,SAAS,GAC3CX,gBACE;QACES,aAAad,aAAac,WAAW;QACrCC,WAAWf,aAAae,SAAS;QACjCC,WAAWhB,aAAagB,SAAS;QACjCC,KAAKjB,aAAaiB,GAAG;IACvB,GACAV,WACGX,OAAOI,aAAae,SAAS,GAClCpB,QAAQK,aAAaiB,GAAG,EAAEV,OAAOkC,IAAI;IAI3C,OAAOE,OAAOjC,IAAI,CAAC,EAAE,EAAEgC,SAAS;AAClC;AAEA,OAAO,eAAeE,sBACpBrC,MAA0F,EAC1FC,EAAO;IAEP,IAAID,OAAOkC,IAAI,IAAIlC,OAAOkC,IAAI,CAACb,MAAM,KAAK,GAAG,OAAO;IAEpD,MAAMnB,WAAWD,MAAMT;IACvB,MAAM8C,UAAU;QACdnD,GAAGM,aAAac,WAAW,EAAEP,OAAOO,WAAW;QAC/CpB,GAAGM,aAAagB,SAAS,EAAET,OAAOS,SAAS;QAC3CX,gBACE;YACES,aAAad,aAAac,WAAW;YACrCC,WAAWf,aAAae,SAAS;YACjCC,WAAWhB,aAAagB,SAAS;YACjCC,KAAKjB,aAAaiB,GAAG;QACvB,GACAV,WACGX,OAAOI,aAAae,SAAS;KACnC;IACD,IAAIR,OAAOkC,IAAI,IAAIlC,OAAOkC,IAAI,CAACb,MAAM,GAAG,GAAG;QACzCiB,QAAQC,IAAI,CAACnD,QAAQK,aAAaiB,GAAG,EAAEV,OAAOkC,IAAI;IACpD;IACA,MAAMM,UAAU,MAAMtC,SACnBuC,MAAM,CAAChD,cACPa,KAAK,CAACpB,OAAOoD,UACbI,SAAS,CAAC;QAACC,IAAIlD,aAAakD,EAAE;IAAA;IACjC,OAAOH,QAAQnB,MAAM;AACvB;AAEA,SAASC,eAAenB,IAAwB;IAC9C,MAAMK,YAAYZ,oBAAoB;QAACY,WAAWL,IAAI,CAAC,EAAE,EAAEK;IAAS;IACpE,MAAMoC,aAAazC,KAAK0C,IAAI,CAC1B,CAAChC,MAAQjB,oBAAoB;YAACY,WAAWK,IAAIL,SAAS;QAAA,OAAOA;IAE/D,IAAIoC,YAAY,MAAM,IAAIrD;IAC1B,OAAOiB;AACT;AAEA,SAASS,mBAAmBjB,MAA6D;IACvF,MAAMQ,YAAYZ,oBAAoBI;IACtC,IAAI,CAACQ,WAAW;QACd,OAAOlB,GAAG,CAAC,eAAe,EAAEU,OAAOO,WAAW,CAAC,iBAAiB,EAAEP,OAAOS,SAAS,CAAC,uBAAuB,CAAC;IAC7G;IACA,OAAOnB,GAAG,CAAC,eAAe,EAAEU,OAAOO,WAAW,CAAC,iBAAiB,EAAEP,OAAOS,SAAS,CAAC,mBAAmB,EAAED,UAAU,uBAAuB,CAAC;AAC5I;AAeA,SAASW,iBAAiBN,GAAmB;IAC3C,OAAO;QACL8B,IAAI9B,IAAI8B,EAAE;QACVpC,aAAaM,IAAIiC,YAAY;QAC7BtC,WAAWK,IAAIkC,UAAU;QACzBtC,WAAWI,IAAIJ,SAAS;QACxBC,KAAKG,IAAIH,GAAG;QACZmB,YAAYhB,IAAIgB,UAAU;QAC1BC,aAAajB,IAAIiB,WAAW;QAC5BkB,WAAWnC,IAAIoC,UAAU;QACzBjB,WAAWnB,IAAIqC,UAAU;QACzBnB,cAAclB,IAAIsC,cAAc;IAClC;AACF"}

package/dist/db/variables.d.ts

@@ -0,0 +1,32 @@
+import { type Tx } from './db.js';
+import { type SecretVariable } from './schema/variables.js';
+import { type StoreScope } from './scope.js';
+export interface SecretVariableWrite {
+    workspaceId: string;
+    projectId: string | null;
+    namespace: string;
+    key: string;
+    value: string;
+    lastEditedBy?: string | null | undefined;
+}
+export declare function getSecretVariableRowWithPrecedence(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    key: string;
+}, tx?: Tx): Promise<SecretVariable | undefined>;
+export declare function listSecretVariableRowsByNamespace(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+}, tx?: Tx): Promise<SecretVariable[]>;
+export declare function upsertSecretVariableRows(rows: SecretVariableWrite[], tx: Tx): Promise<void>;
+export declare function countSecretVariableRows(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    keys: string[];
+}, tx: Tx): Promise<number>;
+export declare function deleteSecretVariableRows(params: StoreScope & {
+    workspaceId: string;
+    namespace: string;
+    keys?: string[] | undefined;
+}, tx?: Tx): Promise<number>;
+//# sourceMappingURL=variables.d.ts.map

package/dist/db/variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../src/db/variables.ts"],"names":[],"mappings":"AAEA,OAAO,EAAK,KAAK,EAAE,EAAC,MAAM,SAAS,CAAC;AACpC,OAAO,EAAC,KAAK,cAAc,EAAoC,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,EAC1E,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAoBrC;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,EAC7D,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,cAAc,EAAE,CAAC,CAW3B;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBjG;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAC7E,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAAC,EAC1F,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/db/variables.js

@@ -0,0 +1,117 @@
+import { and, eq, inArray, isNull, sql } from 'drizzle-orm';
+import { SecretBatchScopeMismatchError } from '#core/errors.js';
+import { db } from './db.js';
+import { secretVariables, toSecretVariable } from './schema/variables.js';
+import { lookupWithPrecedenceWhere, normalizedProjectId, scopeConflictTargetWhere, scopeExactWhere } from './scope.js';
+export async function getSecretVariableRowWithPrecedence(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.select().from(secretVariables).where(lookupWithPrecedenceWhere({
+        workspaceId: secretVariables.workspaceId,
+        projectId: secretVariables.projectId,
+        namespace: secretVariables.namespace,
+        key: secretVariables.key
+    }, params)).orderBy(sql`${secretVariables.projectId} NULLS LAST`).limit(1);
+    const row = rows[0];
+    return row ? toSecretVariable(row) : undefined;
+}
+export async function listSecretVariableRowsByNamespace(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.execute(sql`
+    SELECT DISTINCT ON (key)
+      id, workspace_id, project_id, namespace, key, value,
+      created_at, updated_at, last_edited_by
+    FROM secrets_variables
+    WHERE ${listByNamespaceSql(params)}
+    ORDER BY key, project_id NULLS LAST, id
+  `);
+    return rows.rows.map(rowToSecretVariable);
+}
+export async function upsertSecretVariableRows(rows, tx) {
+    if (rows.length === 0) return;
+    const projectId = batchProjectId(rows);
+    await tx.insert(secretVariables).values(rows).onConflictDoUpdate({
+        target: projectId ? [
+            secretVariables.workspaceId,
+            secretVariables.projectId,
+            secretVariables.namespace,
+            secretVariables.key
+        ] : [
+            secretVariables.workspaceId,
+            secretVariables.namespace,
+            secretVariables.key
+        ],
+        targetWhere: scopeConflictTargetWhere({
+            projectId
+        }),
+        set: {
+            value: sql`excluded.value`,
+            lastEditedBy: sql`excluded.last_edited_by`,
+            updatedAt: sql`NOW()`
+        }
+    });
+}
+export async function countSecretVariableRows(params, tx) {
+    if (params.keys.length === 0) return 0;
+    const rows = await tx.select({
+        count: sql`COUNT(*)`
+    }).from(secretVariables).where(and(eq(secretVariables.workspaceId, params.workspaceId), eq(secretVariables.namespace, params.namespace), scopeExactWhere({
+        workspaceId: secretVariables.workspaceId,
+        projectId: secretVariables.projectId,
+        namespace: secretVariables.namespace,
+        key: secretVariables.key
+    }, params) ?? isNull(secretVariables.projectId), inArray(secretVariables.key, params.keys)));
+    return Number(rows[0]?.count ?? 0);
+}
+export async function deleteSecretVariableRows(params, tx) {
+    if (params.keys && params.keys.length === 0) return 0;
+    const executor = tx ?? db();
+    const filters = [
+        eq(secretVariables.workspaceId, params.workspaceId),
+        eq(secretVariables.namespace, params.namespace),
+        scopeExactWhere({
+            workspaceId: secretVariables.workspaceId,
+            projectId: secretVariables.projectId,
+            namespace: secretVariables.namespace,
+            key: secretVariables.key
+        }, params) ?? isNull(secretVariables.projectId)
+    ];
+    if (params.keys && params.keys.length > 0) {
+        filters.push(inArray(secretVariables.key, params.keys));
+    }
+    const deleted = await executor.delete(secretVariables).where(and(...filters)).returning({
+        id: secretVariables.id
+    });
+    return deleted.length;
+}
+function batchProjectId(rows) {
+    const projectId = normalizedProjectId({
+        projectId: rows[0]?.projectId
+    });
+    const mixedScope = rows.some((row)=>normalizedProjectId({
+            projectId: row.projectId
+        }) !== projectId);
+    if (mixedScope) throw new SecretBatchScopeMismatchError();
+    return projectId;
+}
+function listByNamespaceSql(params) {
+    const projectId = normalizedProjectId(params);
+    if (!projectId) {
+        return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND project_id IS NULL`;
+    }
+    return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND (project_id = ${projectId} OR project_id IS NULL)`;
+}
+function rowToSecretVariable(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        projectId: row.project_id,
+        namespace: row.namespace,
+        key: row.key,
+        value: row.value,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        lastEditedBy: row.last_edited_by
+    };
+}
+
+//# sourceMappingURL=variables.js.map

package/dist/db/variables.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/variables.ts"],"sourcesContent":["import {and, eq, inArray, isNull, sql} from 'drizzle-orm';\nimport {SecretBatchScopeMismatchError} from '#core/errors.js';\nimport {db, type Tx} from './db.js';\nimport {type SecretVariable, secretVariables, toSecretVariable} from './schema/variables.js';\nimport {\n  lookupWithPrecedenceWhere,\n  normalizedProjectId,\n  type StoreScope,\n  scopeConflictTargetWhere,\n  scopeExactWhere,\n} from './scope.js';\n\nexport interface SecretVariableWrite {\n  workspaceId: string;\n  projectId: string | null;\n  namespace: string;\n  key: string;\n  value: string;\n  lastEditedBy?: string | null | undefined;\n}\n\nexport async function getSecretVariableRowWithPrecedence(\n  params: StoreScope & {workspaceId: string; namespace: string; key: string},\n  tx?: Tx,\n): Promise<SecretVariable | undefined> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .select()\n    .from(secretVariables)\n    .where(\n      lookupWithPrecedenceWhere(\n        {\n          workspaceId: secretVariables.workspaceId,\n          projectId: secretVariables.projectId,\n          namespace: secretVariables.namespace,\n          key: secretVariables.key,\n        },\n        params,\n      ),\n    )\n    .orderBy(sql`${secretVariables.projectId} NULLS LAST`)\n    .limit(1);\n  const row = rows[0];\n  return row ? toSecretVariable(row) : undefined;\n}\n\nexport async function listSecretVariableRowsByNamespace(\n  params: StoreScope & {workspaceId: string; namespace: string},\n  tx?: Tx,\n): Promise<SecretVariable[]> {\n  const executor = tx ?? db();\n  const rows = await executor.execute<SecretVariableRow>(sql`\n    SELECT DISTINCT ON (key)\n      id, workspace_id, project_id, namespace, key, value,\n      created_at, updated_at, last_edited_by\n    FROM secrets_variables\n    WHERE ${listByNamespaceSql(params)}\n    ORDER BY key, project_id NULLS LAST, id\n  `);\n  return rows.rows.map(rowToSecretVariable);\n}\n\nexport async function upsertSecretVariableRows(rows: SecretVariableWrite[], tx: Tx): Promise<void> {\n  if (rows.length === 0) return;\n  const projectId = batchProjectId(rows);\n  await tx\n    .insert(secretVariables)\n    .values(rows)\n    .onConflictDoUpdate({\n      target: projectId\n        ? [\n            secretVariables.workspaceId,\n            secretVariables.projectId,\n            secretVariables.namespace,\n            secretVariables.key,\n          ]\n        : [secretVariables.workspaceId, secretVariables.namespace, secretVariables.key],\n      targetWhere: scopeConflictTargetWhere({projectId}),\n      set: {\n        value: sql`excluded.value`,\n        lastEditedBy: sql`excluded.last_edited_by`,\n        updatedAt: sql`NOW()`,\n      },\n    });\n}\n\nexport async function countSecretVariableRows(\n  params: StoreScope & {workspaceId: string; namespace: string; keys: string[]},\n  tx: Tx,\n): Promise<number> {\n  if (params.keys.length === 0) return 0;\n\n  const rows = await tx\n    .select({count: sql<string | number>`COUNT(*)`})\n    .from(secretVariables)\n    .where(\n      and(\n        eq(secretVariables.workspaceId, params.workspaceId),\n        eq(secretVariables.namespace, params.namespace),\n        scopeExactWhere(\n          {\n            workspaceId: secretVariables.workspaceId,\n            projectId: secretVariables.projectId,\n            namespace: secretVariables.namespace,\n            key: secretVariables.key,\n          },\n          params,\n        ) ?? isNull(secretVariables.projectId),\n        inArray(secretVariables.key, params.keys),\n      ),\n    );\n\n  return Number(rows[0]?.count ?? 0);\n}\n\nexport async function deleteSecretVariableRows(\n  params: StoreScope & {workspaceId: string; namespace: string; keys?: string[] | undefined},\n  tx?: Tx,\n): Promise<number> {\n  if (params.keys && params.keys.length === 0) return 0;\n\n  const executor = tx ?? db();\n  const filters = [\n    eq(secretVariables.workspaceId, params.workspaceId),\n    eq(secretVariables.namespace, params.namespace),\n    scopeExactWhere(\n      {\n        workspaceId: secretVariables.workspaceId,\n        projectId: secretVariables.projectId,\n        namespace: secretVariables.namespace,\n        key: secretVariables.key,\n      },\n      params,\n    ) ?? isNull(secretVariables.projectId),\n  ];\n  if (params.keys && params.keys.length > 0) {\n    filters.push(inArray(secretVariables.key, params.keys));\n  }\n  const deleted = await executor\n    .delete(secretVariables)\n    .where(and(...filters))\n    .returning({id: secretVariables.id});\n  return deleted.length;\n}\n\nfunction batchProjectId(rows: SecretVariableWrite[]): string | null {\n  const projectId = normalizedProjectId({projectId: rows[0]?.projectId});\n  const mixedScope = rows.some(\n    (row) => normalizedProjectId({projectId: row.projectId}) !== projectId,\n  );\n  if (mixedScope) throw new SecretBatchScopeMismatchError();\n  return projectId;\n}\n\nfunction listByNamespaceSql(params: StoreScope & {workspaceId: string; namespace: string}) {\n  const projectId = normalizedProjectId(params);\n  if (!projectId) {\n    return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND project_id IS NULL`;\n  }\n  return sql`workspace_id = ${params.workspaceId} AND namespace = ${params.namespace} AND (project_id = ${projectId} OR project_id IS NULL)`;\n}\n\ninterface SecretVariableRow extends Record<string, unknown> {\n  id: string;\n  workspace_id: string;\n  project_id: string | null;\n  namespace: string;\n  key: string;\n  value: string;\n  created_at: Date;\n  updated_at: Date;\n  last_edited_by: string | null;\n}\n\nfunction rowToSecretVariable(row: SecretVariableRow): SecretVariable {\n  return {\n    id: row.id,\n    workspaceId: row.workspace_id,\n    projectId: row.project_id,\n    namespace: row.namespace,\n    key: row.key,\n    value: row.value,\n    createdAt: row.created_at,\n    updatedAt: row.updated_at,\n    lastEditedBy: row.last_edited_by,\n  };\n}\n"],"names":["and","eq","inArray","isNull","sql","SecretBatchScopeMismatchError","db","secretVariables","toSecretVariable","lookupWithPrecedenceWhere","normalizedProjectId","scopeConflictTargetWhere","scopeExactWhere","getSecretVariableRowWithPrecedence","params","tx","executor","rows","select","from","where","workspaceId","projectId","namespace","key","orderBy","limit","row","undefined","listSecretVariableRowsByNamespace","execute","listByNamespaceSql","map","rowToSecretVariable","upsertSecretVariableRows","length","batchProjectId","insert","values","onConflictDoUpdate","target","targetWhere","set","value","lastEditedBy","updatedAt","countSecretVariableRows","keys","count","Number","deleteSecretVariableRows","filters","push","deleted","delete","returning","id","mixedScope","some","workspace_id","project_id","createdAt","created_at","updated_at","last_edited_by"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AAC1D,SAAQC,6BAA6B,QAAO,kBAAkB;AAC9D,SAAQC,EAAE,QAAgB,UAAU;AACpC,SAA6BC,eAAe,EAAEC,gBAAgB,QAAO,wBAAwB;AAC7F,SACEC,yBAAyB,EACzBC,mBAAmB,EAEnBC,wBAAwB,EACxBC,eAAe,QACV,aAAa;AAWpB,OAAO,eAAeC,mCACpBC,MAA0E,EAC1EC,EAAO;IAEP,MAAMC,WAAWD,MAAMT;IACvB,MAAMW,OAAO,MAAMD,SAChBE,MAAM,GACNC,IAAI,CAACZ,iBACLa,KAAK,CACJX,0BACE;QACEY,aAAad,gBAAgBc,WAAW;QACxCC,WAAWf,gBAAgBe,SAAS;QACpCC,WAAWhB,gBAAgBgB,SAAS;QACpCC,KAAKjB,gBAAgBiB,GAAG;IAC1B,GACAV,SAGHW,OAAO,CAACrB,GAAG,CAAC,EAAEG,gBAAgBe,SAAS,CAAC,WAAW,CAAC,EACpDI,KAAK,CAAC;IACT,MAAMC,MAAMV,IAAI,CAAC,EAAE;IACnB,OAAOU,MAAMnB,iBAAiBmB,OAAOC;AACvC;AAEA,OAAO,eAAeC,kCACpBf,MAA6D,EAC7DC,EAAO;IAEP,MAAMC,WAAWD,MAAMT;IACvB,MAAMW,OAAO,MAAMD,SAASc,OAAO,CAAoB1B,GAAG,CAAC;;;;;UAKnD,EAAE2B,mBAAmBjB,QAAQ;;EAErC,CAAC;IACD,OAAOG,KAAKA,IAAI,CAACe,GAAG,CAACC;AACvB;AAEA,OAAO,eAAeC,yBAAyBjB,IAA2B,EAAEF,EAAM;IAChF,IAAIE,KAAKkB,MAAM,KAAK,GAAG;IACvB,MAAMb,YAAYc,eAAenB;IACjC,MAAMF,GACHsB,MAAM,CAAC9B,iBACP+B,MAAM,CAACrB,MACPsB,kBAAkB,CAAC;QAClBC,QAAQlB,YACJ;YACEf,gBAAgBc,WAAW;YAC3Bd,gBAAgBe,SAAS;YACzBf,gBAAgBgB,SAAS;YACzBhB,gBAAgBiB,GAAG;SACpB,GACD;YAACjB,gBAAgBc,WAAW;YAAEd,gBAAgBgB,SAAS;YAAEhB,gBAAgBiB,GAAG;SAAC;QACjFiB,aAAa9B,yBAAyB;YAACW;QAAS;QAChDoB,KAAK;YACHC,OAAOvC,GAAG,CAAC,cAAc,CAAC;YAC1BwC,cAAcxC,GAAG,CAAC,uBAAuB,CAAC;YAC1CyC,WAAWzC,GAAG,CAAC,KAAK,CAAC;QACvB;IACF;AACJ;AAEA,OAAO,eAAe0C,wBACpBhC,MAA6E,EAC7EC,EAAM;IAEN,IAAID,OAAOiC,IAAI,CAACZ,MAAM,KAAK,GAAG,OAAO;IAErC,MAAMlB,OAAO,MAAMF,GAChBG,MAAM,CAAC;QAAC8B,OAAO5C,GAAoB,CAAC,QAAQ,CAAC;IAAA,GAC7Ce,IAAI,CAACZ,iBACLa,KAAK,CACJpB,IACEC,GAAGM,gBAAgBc,WAAW,EAAEP,OAAOO,WAAW,GAClDpB,GAAGM,gBAAgBgB,SAAS,EAAET,OAAOS,SAAS,GAC9CX,gBACE;QACES,aAAad,gBAAgBc,WAAW;QACxCC,WAAWf,gBAAgBe,SAAS;QACpCC,WAAWhB,gBAAgBgB,SAAS;QACpCC,KAAKjB,gBAAgBiB,GAAG;IAC1B,GACAV,WACGX,OAAOI,gBAAgBe,SAAS,GACrCpB,QAAQK,gBAAgBiB,GAAG,EAAEV,OAAOiC,IAAI;IAI9C,OAAOE,OAAOhC,IAAI,CAAC,EAAE,EAAE+B,SAAS;AAClC;AAEA,OAAO,eAAeE,yBACpBpC,MAA0F,EAC1FC,EAAO;IAEP,IAAID,OAAOiC,IAAI,IAAIjC,OAAOiC,IAAI,CAACZ,MAAM,KAAK,GAAG,OAAO;IAEpD,MAAMnB,WAAWD,MAAMT;IACvB,MAAM6C,UAAU;QACdlD,GAAGM,gBAAgBc,WAAW,EAAEP,OAAOO,WAAW;QAClDpB,GAAGM,gBAAgBgB,SAAS,EAAET,OAAOS,SAAS;QAC9CX,gBACE;YACES,aAAad,gBAAgBc,WAAW;YACxCC,WAAWf,gBAAgBe,SAAS;YACpCC,WAAWhB,gBAAgBgB,SAAS;YACpCC,KAAKjB,gBAAgBiB,GAAG;QAC1B,GACAV,WACGX,OAAOI,gBAAgBe,SAAS;KACtC;IACD,IAAIR,OAAOiC,IAAI,IAAIjC,OAAOiC,IAAI,CAACZ,MAAM,GAAG,GAAG;QACzCgB,QAAQC,IAAI,CAAClD,QAAQK,gBAAgBiB,GAAG,EAAEV,OAAOiC,IAAI;IACvD;IACA,MAAMM,UAAU,MAAMrC,SACnBsC,MAAM,CAAC/C,iBACPa,KAAK,CAACpB,OAAOmD,UACbI,SAAS,CAAC;QAACC,IAAIjD,gBAAgBiD,EAAE;IAAA;IACpC,OAAOH,QAAQlB,MAAM;AACvB;AAEA,SAASC,eAAenB,IAA2B;IACjD,MAAMK,YAAYZ,oBAAoB;QAACY,WAAWL,IAAI,CAAC,EAAE,EAAEK;IAAS;IACpE,MAAMmC,aAAaxC,KAAKyC,IAAI,CAC1B,CAAC/B,MAAQjB,oBAAoB;YAACY,WAAWK,IAAIL,SAAS;QAAA,OAAOA;IAE/D,IAAImC,YAAY,MAAM,IAAIpD;IAC1B,OAAOiB;AACT;AAEA,SAASS,mBAAmBjB,MAA6D;IACvF,MAAMQ,YAAYZ,oBAAoBI;IACtC,IAAI,CAACQ,WAAW;QACd,OAAOlB,GAAG,CAAC,eAAe,EAAEU,OAAOO,WAAW,CAAC,iBAAiB,EAAEP,OAAOS,SAAS,CAAC,uBAAuB,CAAC;IAC7G;IACA,OAAOnB,GAAG,CAAC,eAAe,EAAEU,OAAOO,WAAW,CAAC,iBAAiB,EAAEP,OAAOS,SAAS,CAAC,mBAAmB,EAAED,UAAU,uBAAuB,CAAC;AAC5I;AAcA,SAASW,oBAAoBN,GAAsB;IACjD,OAAO;QACL6B,IAAI7B,IAAI6B,EAAE;QACVnC,aAAaM,IAAIgC,YAAY;QAC7BrC,WAAWK,IAAIiC,UAAU;QACzBrC,WAAWI,IAAIJ,SAAS;QACxBC,KAAKG,IAAIH,GAAG;QACZmB,OAAOhB,IAAIgB,KAAK;QAChBkB,WAAWlC,IAAImC,UAAU;QACzBjB,WAAWlB,IAAIoC,UAAU;QACzBnB,cAAcjB,IAAIqC,cAAc;IAClC;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import type { ShipfoxModule } from '@shipfox/node-module';
+export { BUILTIN_LOCAL_STORE, DekUnwrapError, DekWrapError, deleteManagedSecret, deleteManagedVariable, deleteSecrets, deleteVariables, getManagedVariable, getSecret, getSecretsByNamespace, getVariable, getVariablesByNamespace, KekConfigurationError, KekVersionStrandedError, listManagedSecrets, listManagedVariables, NamespaceValidationError, resolveSecretStore, rotateWorkspaceDataKeys, SecretBatchScopeMismatchError, SecretDecryptionError, SecretKeyValidationError, SecretNotFoundError, type SecretStoreProvider, SecretValueTooLargeError, setManagedSecrets, setManagedVariables, setSecrets, setVariables, UnknownSecretStoreError, VariableNotFoundError, WorkspaceSecretCapExceededError, } from '#core/index.js';
+export declare const secretsModule: ShipfoxModule;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAMxD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,uBAAuB,EACvB,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,aAAa,EAAE,aAO3B,CAAC"}

package/dist/index.js

@@ -0,0 +1,28 @@
+import { secretsEventSchemas } from '@shipfox/api-secrets-dto';
+import { db, migrationsPath, secretsOutbox } from '#db/index.js';
+import { registerSecretsServiceMetrics } from '#metrics/index.js';
+import { secretsE2eRoutes } from '#presentation/e2eRoutes/index.js';
+import { secretsRoutes } from '#presentation/routes/index.js';
+export { BUILTIN_LOCAL_STORE, DekUnwrapError, DekWrapError, deleteManagedSecret, deleteManagedVariable, deleteSecrets, deleteVariables, getManagedVariable, getSecret, getSecretsByNamespace, getVariable, getVariablesByNamespace, KekConfigurationError, KekVersionStrandedError, listManagedSecrets, listManagedVariables, NamespaceValidationError, resolveSecretStore, rotateWorkspaceDataKeys, SecretBatchScopeMismatchError, SecretDecryptionError, SecretKeyValidationError, SecretNotFoundError, SecretValueTooLargeError, setManagedSecrets, setManagedVariables, setSecrets, setVariables, UnknownSecretStoreError, VariableNotFoundError, WorkspaceSecretCapExceededError } from '#core/index.js';
+export const secretsModule = {
+    name: 'secrets',
+    database: {
+        db,
+        migrationsPath
+    },
+    routes: secretsRoutes,
+    e2eRoutes: [
+        secretsE2eRoutes
+    ],
+    metrics: registerSecretsServiceMetrics,
+    publishers: [
+        {
+            name: 'secrets',
+            table: secretsOutbox,
+            db,
+            eventSchemas: secretsEventSchemas
+        }
+    ]
+};
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {secretsEventSchemas} from '@shipfox/api-secrets-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {db, migrationsPath, secretsOutbox} from '#db/index.js';\nimport {registerSecretsServiceMetrics} from '#metrics/index.js';\nimport {secretsE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {secretsRoutes} from '#presentation/routes/index.js';\n\nexport {\n  BUILTIN_LOCAL_STORE,\n  DekUnwrapError,\n  DekWrapError,\n  deleteManagedSecret,\n  deleteManagedVariable,\n  deleteSecrets,\n  deleteVariables,\n  getManagedVariable,\n  getSecret,\n  getSecretsByNamespace,\n  getVariable,\n  getVariablesByNamespace,\n  KekConfigurationError,\n  KekVersionStrandedError,\n  listManagedSecrets,\n  listManagedVariables,\n  NamespaceValidationError,\n  resolveSecretStore,\n  rotateWorkspaceDataKeys,\n  SecretBatchScopeMismatchError,\n  SecretDecryptionError,\n  SecretKeyValidationError,\n  SecretNotFoundError,\n  type SecretStoreProvider,\n  SecretValueTooLargeError,\n  setManagedSecrets,\n  setManagedVariables,\n  setSecrets,\n  setVariables,\n  UnknownSecretStoreError,\n  VariableNotFoundError,\n  WorkspaceSecretCapExceededError,\n} from '#core/index.js';\n\nexport const secretsModule: ShipfoxModule = {\n  name: 'secrets',\n  database: {db, migrationsPath},\n  routes: secretsRoutes,\n  e2eRoutes: [secretsE2eRoutes],\n  metrics: registerSecretsServiceMetrics,\n  publishers: [{name: 'secrets', table: secretsOutbox, db, eventSchemas: secretsEventSchemas}],\n};\n"],"names":["secretsEventSchemas","db","migrationsPath","secretsOutbox","registerSecretsServiceMetrics","secretsE2eRoutes","secretsRoutes","BUILTIN_LOCAL_STORE","DekUnwrapError","DekWrapError","deleteManagedSecret","deleteManagedVariable","deleteSecrets","deleteVariables","getManagedVariable","getSecret","getSecretsByNamespace","getVariable","getVariablesByNamespace","KekConfigurationError","KekVersionStrandedError","listManagedSecrets","listManagedVariables","NamespaceValidationError","resolveSecretStore","rotateWorkspaceDataKeys","SecretBatchScopeMismatchError","SecretDecryptionError","SecretKeyValidationError","SecretNotFoundError","SecretValueTooLargeError","setManagedSecrets","setManagedVariables","setSecrets","setVariables","UnknownSecretStoreError","VariableNotFoundError","WorkspaceSecretCapExceededError","secretsModule","name","database","routes","e2eRoutes","metrics","publishers","table","eventSchemas"],"mappings":"AAAA,SAAQA,mBAAmB,QAAO,2BAA2B;AAE7D,SAAQC,EAAE,EAAEC,cAAc,EAAEC,aAAa,QAAO,eAAe;AAC/D,SAAQC,6BAA6B,QAAO,oBAAoB;AAChE,SAAQC,gBAAgB,QAAO,mCAAmC;AAClE,SAAQC,aAAa,QAAO,gCAAgC;AAE5D,SACEC,mBAAmB,EACnBC,cAAc,EACdC,YAAY,EACZC,mBAAmB,EACnBC,qBAAqB,EACrBC,aAAa,EACbC,eAAe,EACfC,kBAAkB,EAClBC,SAAS,EACTC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,qBAAqB,EACrBC,uBAAuB,EACvBC,kBAAkB,EAClBC,oBAAoB,EACpBC,wBAAwB,EACxBC,kBAAkB,EAClBC,uBAAuB,EACvBC,6BAA6B,EAC7BC,qBAAqB,EACrBC,wBAAwB,EACxBC,mBAAmB,EAEnBC,wBAAwB,EACxBC,iBAAiB,EACjBC,mBAAmB,EACnBC,UAAU,EACVC,YAAY,EACZC,uBAAuB,EACvBC,qBAAqB,EACrBC,+BAA+B,QAC1B,iBAAiB;AAExB,OAAO,MAAMC,gBAA+B;IAC1CC,MAAM;IACNC,UAAU;QAACvC;QAAIC;IAAc;IAC7BuC,QAAQnC;IACRoC,WAAW;QAACrC;KAAiB;IAC7BsC,SAASvC;IACTwC,YAAY;QAAC;YAACL,MAAM;YAAWM,OAAO1C;YAAeF;YAAI6C,cAAc9C;QAAmB;KAAE;AAC9F,EAAE"}

package/dist/metrics/index.d.ts

@@ -0,0 +1,3 @@
+export { classifyDekAccessError, classifyKekRotationError, classifySecretsOperationError, operationScope, recordSecretsDekAccess, recordSecretsEntriesMutated, recordSecretsKekRotation, recordSecretsOperation, type SecretsDekAccessOutcome, type SecretsKekRotationOutcome, type SecretsMetricOperation, type SecretsMetricResource, type SecretsMetricScope, type SecretsMetricSurface, type SecretsMutationEffect, type SecretsOperationOutcome, } from './instance.js';
+export { registerSecretsServiceMetrics } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/metrics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/metrics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,6BAA6B,EAAC,MAAM,cAAc,CAAC"}

package/dist/metrics/index.js

@@ -0,0 +1,4 @@
+export { classifyDekAccessError, classifyKekRotationError, classifySecretsOperationError, operationScope, recordSecretsDekAccess, recordSecretsEntriesMutated, recordSecretsKekRotation, recordSecretsOperation } from './instance.js';
+export { registerSecretsServiceMetrics } from './service.js';
+
+//# sourceMappingURL=index.js.map

package/dist/metrics/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/metrics/index.ts"],"sourcesContent":["export {\n  classifyDekAccessError,\n  classifyKekRotationError,\n  classifySecretsOperationError,\n  operationScope,\n  recordSecretsDekAccess,\n  recordSecretsEntriesMutated,\n  recordSecretsKekRotation,\n  recordSecretsOperation,\n  type SecretsDekAccessOutcome,\n  type SecretsKekRotationOutcome,\n  type SecretsMetricOperation,\n  type SecretsMetricResource,\n  type SecretsMetricScope,\n  type SecretsMetricSurface,\n  type SecretsMutationEffect,\n  type SecretsOperationOutcome,\n} from './instance.js';\nexport {registerSecretsServiceMetrics} from './service.js';\n"],"names":["classifyDekAccessError","classifyKekRotationError","classifySecretsOperationError","operationScope","recordSecretsDekAccess","recordSecretsEntriesMutated","recordSecretsKekRotation","recordSecretsOperation","registerSecretsServiceMetrics"],"mappings":"AAAA,SACEA,sBAAsB,EACtBC,wBAAwB,EACxBC,6BAA6B,EAC7BC,cAAc,EACdC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wBAAwB,EACxBC,sBAAsB,QASjB,gBAAgB;AACvB,SAAQC,6BAA6B,QAAO,eAAe"}

package/dist/metrics/instance.d.ts

@@ -0,0 +1,39 @@
+export type SecretsMetricResource = 'secret' | 'variable';
+export type SecretsMetricOperation = 'get' | 'get_namespace' | 'set' | 'delete' | 'list';
+export type SecretsMetricSurface = 'internal' | 'management';
+export type SecretsMetricScope = 'workspace' | 'project';
+export type SecretsOperationOutcome = 'success' | 'not_found' | 'validation_failed' | 'cap_exceeded' | 'value_too_large' | 'decryption_failed' | 'crypto_failed' | 'failure';
+export type SecretsMutationEffect = 'created' | 'updated' | 'deleted';
+export type SecretsDekAccessOutcome = 'cache_hit' | 'cache_expired' | 'db_unwrapped' | 'generated' | 'unwrap_failed' | 'wrap_failed' | 'failure';
+export type SecretsKekRotationOutcome = 'rotated' | 'skipped_current' | 'skipped_race' | 'none' | 'stranded' | 'failure';
+export declare function operationScope(params: {
+    projectId?: string | null | undefined;
+}): SecretsMetricScope;
+export declare function classifySecretsOperationError(error: unknown): SecretsOperationOutcome;
+export declare function recordSecretsOperation(params: {
+    resource: SecretsMetricResource;
+    operation: SecretsMetricOperation;
+    surface: SecretsMetricSurface;
+    scope: SecretsMetricScope;
+    outcome: SecretsOperationOutcome;
+    durationMs: number;
+}): void;
+export declare function recordSecretsEntriesMutated(params: {
+    resource: SecretsMetricResource;
+    operation: 'set' | 'delete';
+    effect: SecretsMutationEffect;
+    surface: SecretsMetricSurface;
+    count: number;
+}): void;
+export declare function recordSecretsDekAccess(params: {
+    outcome: SecretsDekAccessOutcome;
+    durationMs: number;
+}): void;
+export declare function classifyDekAccessError(error: unknown): SecretsDekAccessOutcome;
+export declare function recordSecretsKekRotation(params: {
+    outcome: SecretsKekRotationOutcome;
+    count?: number | undefined;
+    durationMs?: number | undefined;
+}): void;
+export declare function classifyKekRotationError(error: unknown): SecretsKekRotationOutcome;
+//# sourceMappingURL=instance.d.ts.map

package/dist/metrics/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC1D,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AACzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,YAAY,CAAC;AAC7D,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,SAAS,CAAC;AACzD,MAAM,MAAM,uBAAuB,GAC/B,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,cAAc,GACd,iBAAiB,GACjB,mBAAmB,GACnB,eAAe,GACf,SAAS,CAAC;AACd,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAC/B,WAAW,GACX,eAAe,GACf,cAAc,GACd,WAAW,GACX,eAAe,GACf,aAAa,GACb,SAAS,CAAC;AACd,MAAM,MAAM,yBAAyB,GACjC,SAAS,GACT,iBAAiB,GACjB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,CAAC;AAqEd,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC,GAAG,kBAAkB,CAErB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAkBrF;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;IAClC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,uBAAuB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAYP;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,IAAI,CAWP;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,OAAO,EAAE,uBAAuB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAKP;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAI9E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,yBAAyB,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GAAG,IAAI,CAUP;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAIlF"}