@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.1

package/dist/server/integration-accounts/schemas/connection.js

@@ -0,0 +1,44 @@
+import * as z from 'zod/v4';
+import { EnvironmentTierSchema } from '@vibesdotdev/kernel';
+import { IntegrationConfigValueSchema } from '@vibesdotdev/integrations/schemas/integration-descriptor';
+const SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+export const CiJobSecretDelegationInputSchema = z.object({
+    actionRunId: z.uuid(),
+    step: z.string().trim().min(1).max(160),
+    ownerType: z.enum(['user', 'organization']),
+    ownerId: z.string().trim().min(1),
+    targetTier: EnvironmentTierSchema.optional()
+}).strict();
+export const CiJobSecretReadRequestSchema = CiJobSecretDelegationInputSchema.extend({
+    secretName: z.string().regex(SECRET_NAME_PATTERN)
+}).strict();
+export const VerifiedCiJobSecretAuthoritySchema = CiJobSecretDelegationInputSchema.extend({
+    attemptId: z.uuid(),
+    targetTier: EnvironmentTierSchema,
+    allowedSecrets: z.array(z.string().regex(SECRET_NAME_PATTERN)).min(1)
+}).strict();
+export const ConnectionConfigSchema = z.record(z.string(), IntegrationConfigValueSchema);
+export const MailIdentitySchema = z.object({
+    fromEmail: z.string().trim().optional(),
+    fromName: z.string().trim().optional()
+});
+export const CredentialStateSchema = z.object({
+    expiresAt: z.string().nullable().optional(),
+    status: z.string().optional()
+});
+export const DeploymentAuthoritySchema = z.object({
+    deploymentId: z.string().trim().min(1),
+    agentId: z.string().trim().min(1),
+    ownerUserId: z.string().trim().min(1),
+    organizationId: z.string().optional(),
+    integrationId: z.string().trim().min(1),
+    sourceId: z.string().trim().min(1),
+    channelId: z.string().trim().min(1),
+    guildId: z.string().optional(),
+    connectionId: z.string().optional()
+});
+export const DeploymentVerificationSchema = z.object({
+    allowed: z.boolean().optional(),
+    authority: DeploymentAuthoritySchema.optional()
+});
+//# sourceMappingURL=connection.js.map

package/dist/server/integration-accounts/schemas/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../../src/server/integration-accounts/schemas/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAqB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAGxG,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAE7D,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,CAAC,MAAM,CAAC;IACnF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACjD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,gCAAgC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,UAAU,EAAE,qBAAqB;IACjC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrE,CAAC,CAAC,MAAM,EAAE,CAAC;AASZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC"}

package/dist/server/integration-accounts/schemas/project-permissions.d.ts

@@ -0,0 +1,14 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+export interface ProjectPermissionCheckInput {
+    userId: string;
+    projectId: string;
+    permission: SecretProjectPermission;
+}
+export type SecretProjectPermission = 'secrets:read' | 'secrets:write' | 'secrets:delete';
+export type ProjectPermissionChecker = (input: ProjectPermissionCheckInput) => Promise<boolean> | boolean;
+export declare class ProjectPermissionCheckerNotConfiguredError extends CapabilityError {
+    readonly permission: SecretProjectPermission;
+    readonly projectId: string;
+    constructor(permission: SecretProjectPermission, projectId: string);
+}
+//# sourceMappingURL=project-permissions.d.ts.map

package/dist/server/integration-accounts/schemas/project-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-permissions.d.ts","sourceRoot":"","sources":["../../../../src/server/integration-accounts/schemas/project-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,2BAA2B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAE1F,MAAM,MAAM,wBAAwB,GAAG,CACtC,KAAK,EAAE,2BAA2B,KAC9B,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAEhC,qBAAa,0CAA2C,SAAQ,eAAe;IAC9E,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,UAAU,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM;CAQlE"}

package/dist/server/integration-accounts/schemas/project-permissions.js

@@ -0,0 +1,12 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+export class ProjectPermissionCheckerNotConfiguredError extends CapabilityError {
+    permission;
+    projectId;
+    constructor(permission, projectId) {
+        super('Project permission checker is not configured.', 'UNAVAILABLE', { reason: 'project-permission-checker-not-configured' });
+        this.name = 'ProjectPermissionCheckerNotConfiguredError';
+        this.permission = permission;
+        this.projectId = projectId;
+    }
+}
+//# sourceMappingURL=project-permissions.js.map

package/dist/server/integration-accounts/schemas/project-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-permissions.js","sourceRoot":"","sources":["../../../../src/server/integration-accounts/schemas/project-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AActD,MAAM,OAAO,0CAA2C,SAAQ,eAAe;IACrE,UAAU,CAA0B;IACpC,SAAS,CAAS;IAC3B,YAAY,UAAmC,EAAE,SAAiB;QACjE,KAAK,CACJ,+CAA+C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE,CACvH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4CAA4C,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;CACD"}

package/dist/server/integration-accounts/secret-service.d.ts

@@ -0,0 +1,102 @@
+import { type SelectedSecret, type Secret } from './secrets';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type CreateSecretInput, type UpdateSecretInput, type ListSecretsOptions, type DeleteByQueryInput, type DecryptedSecret, type SecretReadContext, type SecretServiceContext } from './secret-types';
+import { type ProjectPermissionChecker } from './schemas/project-permissions';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+/**
+ * Service for managing encrypted secrets with access control
+ */
+type PlatformDb = DrizzleDb;
+export declare class SecretService {
+    private readonly checkProjectPermission;
+    private encryption;
+    private db;
+    constructor(db: PlatformDb, runtime: RuntimeRef, checkProjectPermission?: ProjectPermissionChecker);
+    /**
+     * Create a new secret
+     */
+    create(data: CreateSecretInput, context: SecretServiceContext): Promise<SelectedSecret>;
+    /**
+     * Get a secret by ID (without decrypting the value).
+     *
+     * Fail-closed multi-tenant: unreadable / foreign secrets return `null`
+     * (same as missing) so callers map to **404**, never **403**. Throwing
+     * {@link SecretAccessDeniedError} here was an existence oracle for private
+     * foreign UUIDs on every route that only handled the null branch.
+     */
+    get(id: string, context: SecretReadContext): Promise<SelectedSecret | null>;
+    /**
+     * Get and decrypt a secret value
+     */
+    decrypt(id: string, context: SecretReadContext): Promise<string>;
+    /**
+     * Backward-compatible alias used by existing routes.
+     * Returns null only for absent or inaccessible records; storage failures remain failures.
+     */
+    getDecryptedValue(id: string, context: SecretReadContext): Promise<string | null>;
+    /**
+     * Get a secret with decrypted value
+     */
+    getDecrypted(id: string, context: SecretReadContext): Promise<DecryptedSecret>;
+    /**
+     * List secrets with optional filtering.
+     *
+     * When context.orgId is provided and no explicit scopeId is given,
+     * org-scoped secrets are automatically filtered to those whose
+     * scopeId starts with the orgId prefix. This prevents cross-org
+     * data leakage in admin views and integration credential lookups.
+     */
+    list(options: ListSecretsOptions, context: SecretReadContext): Promise<SelectedSecret[]>;
+    private matchesOrgScopeId;
+    /**
+     * Update a secret
+     */
+    update(id: string, data: UpdateSecretInput, context: SecretServiceContext): Promise<SelectedSecret>;
+    /**
+     * Delete a secret
+     */
+    delete(id: string, context: SecretServiceContext): Promise<void>;
+    /**
+     * Service-level batch delete by query.
+     *
+     * Used by OAuth flows to clear existing tokens before rotation
+     * without fetching+permission-checking each row individually. The
+     * scope/scopeId pair gates access via the same rules as create —
+     * the caller must own the scope or be a superuser.
+     *
+     * Returns the number of rows deleted.
+     */
+    deleteByQuery(query: DeleteByQueryInput, context: SecretServiceContext): Promise<number>;
+    /**
+     * Record secret usage
+     */
+    recordUsage(id: string): Promise<void>;
+    /**
+     * Get secrets for a specific provider type and scope
+     */
+    getByProvider(providerType: string, context: SecretReadContext): Promise<Secret[]>;
+    /**
+     * Check permissions for creating a secret
+     */
+    private checkCreatePermissions;
+    /**
+     * Scope-level write permission check used by `create` and
+     * `deleteByQuery`. Validates whether `context` may write to a
+     * (scope, scopeId) pair without requiring an existing secret row.
+     */
+    private checkScopeWritePermission;
+    /**
+     * Check permissions for reading a secret
+     */
+    private canRead;
+    /**
+     * Check permissions for writing a secret
+     */
+    private checkWritePermissions;
+    /**
+     * Check permissions for deleting a secret
+     */
+    private checkDeletePermissions;
+}
+export {};
+//# sourceMappingURL=secret-service.d.ts.map

package/dist/server/integration-accounts/secret-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-service.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/secret-service.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,KAAK,cAAc,EACnB,KAAK,MAAM,EAEX,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAKzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA8C,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC1H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEvE;;GAEG;AACH,KAAK,UAAU,GAAG,SAAS,CAAC;AAE5B,qBAAa,aAAa;IAIwB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAHxF,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,EAAE,CAAa;gBAEX,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAmB,sBAAsB,GAAE,wBAAgJ;IAK1O;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IA8C7F;;;;;;;OAOG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAYjF;;OAEG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAatE;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUvF;;OAEG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAcpF;;;;;;;OAOG;IACG,IAAI,CACT,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,iBAAiB,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAwE5B,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACG,MAAM,CACX,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,cAAc,CAAC;IA2C1B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtE;;;;;;;;;OASG;IACG,aAAa,CAClB,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,MAAM,CAAC;IAoBlB;;OAEG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C;;OAEG;IACH,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IASlF;;OAEG;YACW,sBAAsB;IAapC;;;;OAIG;YACW,yBAAyB;IA2CvC;;OAEG;YACW,OAAO;IA0CrB;;OAEG;YACW,qBAAqB;IAoDnC;;OAEG;YACW,sBAAsB;CAmDpC"}

package/dist/server/integration-accounts/secret-service.js

@@ -0,0 +1,482 @@
+import { and, desc, eq } from 'drizzle-orm';
+import { secrets, selectSecretSchema, insertSecretSchema } from './secrets';
+import { SecretEncryption } from '@vibesdotdev/security/encryption';
+import { settle } from '@vibesdotdev/kernel';
+import { SecretNotFoundError, SecretAccessDeniedError, SecretEncryptionError, SecretValidationError } from './secret-types';
+import { ProjectPermissionCheckerNotConfiguredError } from './schemas/project-permissions';
+export class SecretService {
+    checkProjectPermission;
+    encryption;
+    db;
+    constructor(db, runtime, checkProjectPermission = async ({ permission, projectId }) => { throw new ProjectPermissionCheckerNotConfiguredError(permission, projectId); }) {
+        this.checkProjectPermission = checkProjectPermission;
+        this.db = db;
+        this.encryption = new SecretEncryption(runtime);
+    }
+    /**
+     * Create a new secret
+     */
+    async create(data, context) {
+        const result = await settle(async () => {
+            // Check permissions first (before validation)
+            await this.checkCreatePermissions(data, context);
+            // Validate input
+            const now = new Date();
+            const validatedData = insertSecretSchema.required({ id: true, createdAt: true, updatedAt: true }).parse({
+                id: crypto.randomUUID(),
+                name: data.name,
+                scope: data.scope,
+                scopeId: data.scopeId,
+                providerType: data.providerType,
+                encryptedValue: await this.encryption.encryptForStorage(data.value),
+                createdBy: context.userId,
+                createdAt: now,
+                updatedAt: now,
+                metadata: data.metadata
+            });
+            // Insert into database
+            const [newSecret] = await this.db.insert(secrets).values(validatedData).returning();
+            return selectSecretSchema.parse(newSecret);
+        });
+        if (!result.ok) {
+            const error = result.cause;
+            // Re-throw our custom errors as-is
+            if (error instanceof SecretAccessDeniedError ||
+                error instanceof SecretNotFoundError ||
+                error instanceof SecretEncryptionError ||
+                error instanceof SecretValidationError) {
+                throw error;
+            }
+            // Convert other errors to validation errors
+            if (error instanceof Error) {
+                throw new SecretValidationError('Invalid secret.', error);
+            }
+            throw error;
+        }
+        return result.value;
+    }
+    /**
+     * Get a secret by ID (without decrypting the value).
+     *
+     * Fail-closed multi-tenant: unreadable / foreign secrets return `null`
+     * (same as missing) so callers map to **404**, never **403**. Throwing
+     * {@link SecretAccessDeniedError} here was an existence oracle for private
+     * foreign UUIDs on every route that only handled the null branch.
+     */
+    async get(id, context) {
+        const [secret] = await this.db.select().from(secrets).where(eq(secrets.id, id)).limit(1);
+        if (!secret) {
+            return null;
+        }
+        if (!await this.canRead(secret, context))
+            return null;
+        return selectSecretSchema.parse(secret);
+    }
+    /**
+     * Get and decrypt a secret value
+     */
+    async decrypt(id, context) {
+        const secret = await this.get(id, context);
+        if (!secret) {
+            throw new SecretNotFoundError(id);
+        }
+        // Storage failures must not be disguised as missing or invalid ciphertext.
+        await this.recordUsage(id);
+        const result = await settle(() => this.encryption.decryptFromStorage(secret.encryptedValue));
+        if (!result.ok)
+            throw new SecretEncryptionError('Failed to decrypt secret.', result.cause);
+        return result.value;
+    }
+    /**
+     * Backward-compatible alias used by existing routes.
+     * Returns null only for absent or inaccessible records; storage failures remain failures.
+     */
+    async getDecryptedValue(id, context) {
+        const result = await settle(() => this.decrypt(id, context));
+        if (!result.ok) {
+            const error = result.cause;
+            if (error instanceof SecretNotFoundError || error instanceof SecretAccessDeniedError)
+                return null;
+            throw error;
+        }
+        return result.value;
+    }
+    /**
+     * Get a secret with decrypted value
+     */
+    async getDecrypted(id, context) {
+        const secret = await this.get(id, context);
+        if (!secret) {
+            throw new SecretNotFoundError(id);
+        }
+        const decryptedValue = await this.decrypt(id, context);
+        return {
+            ...secret,
+            value: decryptedValue
+        };
+    }
+    /**
+     * List secrets with optional filtering.
+     *
+     * When context.orgId is provided and no explicit scopeId is given,
+     * org-scoped secrets are automatically filtered to those whose
+     * scopeId starts with the orgId prefix. This prevents cross-org
+     * data leakage in admin views and integration credential lookups.
+     */
+    async list(options, context) {
+        // Use the simpler query builder pattern that works with TypeScript
+        const baseQuery = this.db.select().from(secrets).orderBy(desc(secrets.createdAt));
+        // Build where conditions
+        const conditions = [];
+        if (options.scope && options.scopeId) {
+            // Explicit scope filter requested
+            conditions.push(eq(secrets.scope, options.scope));
+            conditions.push(eq(secrets.scopeId, options.scopeId));
+        }
+        else if (options.scope === 'org') {
+            if (!context.orgId) {
+                return [];
+            }
+            conditions.push(eq(secrets.scope, 'org'));
+        }
+        else if (context.orgId && !options.scopeId) {
+            // Auto-scope org secrets to the requesting org when no explicit scopeId
+            conditions.push(eq(secrets.scope, 'org'));
+        }
+        else if (context.isSuperuser) {
+            // Platform admins default to platform-scoped secrets when no org is selected.
+            conditions.push(eq(secrets.scope, 'platform'));
+        }
+        else if (context.userId && !context.isSuperuser) {
+            // For regular users without explicit scope, default to their own user-scoped secrets
+            conditions.push(eq(secrets.scope, 'user'));
+            conditions.push(eq(secrets.scopeId, context.userId));
+        }
+        if (options.providerType) {
+            conditions.push(eq(secrets.providerType, options.providerType));
+        }
+        // Execute query with conditions and pagination
+        let results;
+        if (conditions.length > 0) {
+            const queryWithWhere = baseQuery.where(and(...conditions));
+            if (options.limit) {
+                const queryWithLimit = queryWithWhere.limit(options.limit);
+                if (options.offset) {
+                    results = await queryWithLimit.offset(options.offset);
+                }
+                else {
+                    results = await queryWithLimit;
+                }
+            }
+            else {
+                results = await queryWithWhere;
+            }
+        }
+        else if (options.limit) {
+            const queryWithLimit = baseQuery.limit(options.limit);
+            if (options.offset) {
+                results = await queryWithLimit.offset(options.offset);
+            }
+            else {
+                results = await queryWithLimit;
+            }
+        }
+        else {
+            results = await baseQuery;
+        }
+        if (context.orgId && (!options.scopeId || options.scope === 'org')) {
+            results = results.filter((secret) => secret.scope !== 'org' || this.matchesOrgScopeId(secret.scopeId, context.orgId));
+        }
+        // Filter by permissions
+        const filteredResults = [];
+        for (const secret of results) {
+            if (await this.canRead(secret, context)) {
+                filteredResults.push(selectSecretSchema.parse(secret));
+            }
+        }
+        return filteredResults;
+    }
+    matchesOrgScopeId(scopeId, orgId) {
+        return scopeId === orgId || scopeId.startsWith(`${orgId}:`);
+    }
+    /**
+     * Update a secret
+     */
+    async update(id, data, context) {
+        const existingSecret = await this.get(id, context);
+        if (!existingSecret) {
+            throw new SecretNotFoundError(id);
+        }
+        // Check permissions
+        await this.checkWritePermissions(existingSecret, context);
+        const result = await settle(async () => {
+            const updateData = {
+                updatedAt: new Date()
+            };
+            if (data.name !== undefined) {
+                updateData.name = data.name;
+            }
+            if (data.value !== undefined) {
+                updateData.encryptedValue = await this.encryption.encryptForStorage(data.value);
+                updateData.lastRotatedAt = new Date();
+            }
+            if (data.metadata !== undefined) {
+                updateData.metadata = data.metadata;
+            }
+            const [updatedSecret] = await this.db
+                .update(secrets)
+                .set(updateData)
+                .where(eq(secrets.id, id))
+                .returning();
+            return selectSecretSchema.parse(updatedSecret);
+        });
+        if (!result.ok) {
+            const error = result.cause;
+            if (error instanceof Error) {
+                throw new SecretValidationError('Invalid secret.', error);
+            }
+            throw error;
+        }
+        return result.value;
+    }
+    /**
+     * Delete a secret
+     */
+    async delete(id, context) {
+        const existingSecret = await this.get(id, context);
+        if (!existingSecret) {
+            throw new SecretNotFoundError(id);
+        }
+        // Check permissions
+        await this.checkDeletePermissions(existingSecret, context);
+        await this.db.delete(secrets).where(eq(secrets.id, id));
+    }
+    /**
+     * Service-level batch delete by query.
+     *
+     * Used by OAuth flows to clear existing tokens before rotation
+     * without fetching+permission-checking each row individually. The
+     * scope/scopeId pair gates access via the same rules as create —
+     * the caller must own the scope or be a superuser.
+     *
+     * Returns the number of rows deleted.
+     */
+    async deleteByQuery(query, context) {
+        await this.checkScopeWritePermission(query.scope, query.scopeId, context);
+        const conditions = [
+            eq(secrets.scope, query.scope),
+            eq(secrets.scopeId, query.scopeId),
+            eq(secrets.providerType, query.providerType)
+        ];
+        if (query.name !== undefined) {
+            conditions.push(eq(secrets.name, query.name));
+        }
+        const result = await this.db
+            .delete(secrets)
+            .where(and(...conditions))
+            .returning({ id: secrets.id });
+        return result.length;
+    }
+    /**
+     * Record secret usage
+     */
+    async recordUsage(id) {
+        await this.db.update(secrets).set({ lastUsedAt: new Date() }).where(eq(secrets.id, id));
+    }
+    /**
+     * Get secrets for a specific provider type and scope
+     */
+    getByProvider(providerType, context) {
+        return this.list({
+            providerType
+        }, context);
+    }
+    /**
+     * Check permissions for creating a secret
+     */
+    async checkCreatePermissions(data, context) {
+        const result = await settle(() => this.checkScopeWritePermission(data.scope, data.scopeId, context));
+        if (!result.ok) {
+            if (result.cause instanceof SecretAccessDeniedError) {
+                throw new SecretAccessDeniedError('new', 'create', result.cause);
+            }
+            throw result.cause;
+        }
+    }
+    /**
+     * Scope-level write permission check used by `create` and
+     * `deleteByQuery`. Validates whether `context` may write to a
+     * (scope, scopeId) pair without requiring an existing secret row.
+     */
+    async checkScopeWritePermission(scope, scopeId, context) {
+        const id = `${scope}:${scopeId}`;
+        switch (scope) {
+            case 'user':
+                if (scopeId !== context.userId && !context.isSuperuser) {
+                    throw new SecretAccessDeniedError(id, 'write');
+                }
+                break;
+            case 'project': {
+                if (!context.projectId || !context.userId) {
+                    throw new SecretAccessDeniedError(id, 'write');
+                }
+                const canWrite = await this.checkProjectPermission({
+                    userId: context.userId,
+                    projectId: context.projectId,
+                    permission: 'secrets:write'
+                });
+                if (!canWrite && !context.isSuperuser) {
+                    throw new SecretAccessDeniedError(id, 'write');
+                }
+                break;
+            }
+            case 'org':
+                if (!context.isSuperuser &&
+                    (!context.orgId ||
+                        (scopeId !== context.orgId && !scopeId.startsWith(`${context.orgId}:`)))) {
+                    throw new SecretAccessDeniedError(id, 'write');
+                }
+                break;
+            case 'platform':
+                if (!context.isSuperuser) {
+                    throw new SecretAccessDeniedError(id, 'write');
+                }
+                break;
+        }
+    }
+    /**
+     * Check permissions for reading a secret
+     */
+    async canRead(secret, context) {
+        switch (secret.scope) {
+            case 'user':
+                if (secret.scopeId !== context.userId && !context.isSuperuser) {
+                    return false;
+                }
+                break;
+            case 'project':
+                if (secret.scopeId !== context.projectId && !context.isSuperuser) {
+                    return false;
+                }
+                if (context.projectId) {
+                    if (!context.userId)
+                        return context.isSuperuser === true;
+                    const canRead = await this.checkProjectPermission({
+                        userId: context.userId,
+                        projectId: context.projectId,
+                        permission: 'secrets:read'
+                    });
+                    if (!canRead && !context.isSuperuser) {
+                        return false;
+                    }
+                }
+                break;
+            case 'org':
+                if (!context.isSuperuser &&
+                    (!context.orgId ||
+                        (secret.scopeId !== context.orgId && !secret.scopeId.startsWith(`${context.orgId}:`)))) {
+                    return false;
+                }
+                break;
+            case 'platform':
+                if (!context.isSuperuser) {
+                    return false;
+                }
+                break;
+        }
+        return true;
+    }
+    /**
+     * Check permissions for writing a secret
+     */
+    async checkWritePermissions(secret, context) {
+        switch (secret.scope) {
+            case 'user':
+                if (secret.scopeId !== context.userId &&
+                    secret.createdBy !== context.userId &&
+                    !context.isSuperuser) {
+                    throw new SecretAccessDeniedError(secret.id, 'write');
+                }
+                break;
+            case 'project':
+                if (secret.scopeId !== context.projectId && !context.isSuperuser) {
+                    throw new SecretAccessDeniedError(secret.id, 'write');
+                }
+                if (context.projectId) {
+                    if (!context.userId) {
+                        if (!context.isSuperuser)
+                            throw new SecretAccessDeniedError(secret.id, 'write');
+                        break;
+                    }
+                    const canWrite = await this.checkProjectPermission({
+                        userId: context.userId,
+                        projectId: context.projectId,
+                        permission: 'secrets:write'
+                    });
+                    if (!canWrite && !context.isSuperuser) {
+                        throw new SecretAccessDeniedError(secret.id, 'write');
+                    }
+                }
+                break;
+            case 'org':
+                if (!context.isSuperuser &&
+                    (!context.orgId ||
+                        (secret.scopeId !== context.orgId && !secret.scopeId.startsWith(`${context.orgId}:`)))) {
+                    throw new SecretAccessDeniedError(secret.id, 'write');
+                }
+                break;
+            case 'platform':
+                if (!context.isSuperuser) {
+                    throw new SecretAccessDeniedError(secret.id, 'write');
+                }
+                break;
+        }
+    }
+    /**
+     * Check permissions for deleting a secret
+     */
+    async checkDeletePermissions(secret, context) {
+        switch (secret.scope) {
+            case 'user':
+                if (secret.scopeId !== context.userId &&
+                    secret.createdBy !== context.userId &&
+                    !context.isSuperuser) {
+                    throw new SecretAccessDeniedError(secret.id, 'delete');
+                }
+                break;
+            case 'project':
+                if (secret.scopeId !== context.projectId && !context.isSuperuser) {
+                    throw new SecretAccessDeniedError(secret.id, 'delete');
+                }
+                if (context.projectId) {
+                    if (!context.userId) {
+                        if (!context.isSuperuser)
+                            throw new SecretAccessDeniedError(secret.id, 'delete');
+                        break;
+                    }
+                    const canDelete = await this.checkProjectPermission({
+                        userId: context.userId,
+                        projectId: context.projectId,
+                        permission: 'secrets:delete'
+                    });
+                    if (!canDelete && !context.isSuperuser) {
+                        throw new SecretAccessDeniedError(secret.id, 'delete');
+                    }
+                }
+                break;
+            case 'org':
+                if (!context.isSuperuser &&
+                    (!context.orgId ||
+                        (secret.scopeId !== context.orgId && !secret.scopeId.startsWith(`${context.orgId}:`)))) {
+                    throw new SecretAccessDeniedError(secret.id, 'delete');
+                }
+                break;
+            case 'platform':
+                if (!context.isSuperuser) {
+                    throw new SecretAccessDeniedError(secret.id, 'delete');
+                }
+                break;
+        }
+    }
+}
+//# sourceMappingURL=secret-service.js.map