import {
  decryptValue,
  encryptValue
} from "./chunk-AIBH32FN.js";
import {
  DEFAULT_TENANT_ID
} from "./chunk-X27B5TCC.js";
import {
  init_ids,
  newId
} from "./chunk-F4WUVOLE.js";
import {
  init_clock,
  nowMs,
  toIso
} from "./chunk-HFDLUBWN.js";
import {
  getDrizzle,
  init_drizzle
} from "./chunk-RII4M3J2.js";
import {
  schema_exports
} from "./chunk-DDJOPRB7.js";

// src/db/vaults.ts
init_drizzle();
init_ids();
init_clock();
import { eq, and, asc, desc, isNull } from "drizzle-orm";
function hydrateVault(row) {
  let metadata = {};
  try {
    metadata = JSON.parse(row.metadata_json || "{}");
  } catch {
  }
  return {
    type: "vault",
    id: row.id,
    agent_id: row.agent_id,
    name: row.name,
    display_name: row.name,
    metadata,
    created_at: toIso(row.created_at),
    updated_at: toIso(row.updated_at),
    archived_at: row.archived_at ? toIso(row.archived_at) : null
  };
}
function createVault(input) {
  const db = getDrizzle();
  const id = newId("vlt");
  const now = nowMs();
  db.insert(schema_exports.vaults).values({
    id,
    agent_id: input.agent_id ?? null,
    name: input.name,
    metadata_json: JSON.stringify(input.metadata ?? {}),
    tenant_id: input.tenant_id ?? DEFAULT_TENANT_ID,
    created_at: now,
    updated_at: now
  }).run();
  return getVault(id);
}
function getVault(id) {
  const db = getDrizzle();
  const row = db.select().from(schema_exports.vaults).where(eq(schema_exports.vaults.id, id)).get();
  return row ? hydrateVault(row) : null;
}
function listVaults(opts) {
  const db = getDrizzle();
  const conditions = [];
  if (opts.agent_id) {
    conditions.push(eq(schema_exports.vaults.agent_id, opts.agent_id));
  }
  if (opts.tenantFilter != null) {
    conditions.push(eq(schema_exports.vaults.tenant_id, opts.tenantFilter));
  }
  const where = conditions.length ? and(...conditions) : void 0;
  const rows = where ? db.select().from(schema_exports.vaults).where(where).orderBy(desc(schema_exports.vaults.created_at)).all() : db.select().from(schema_exports.vaults).orderBy(desc(schema_exports.vaults.created_at)).all();
  return rows.map(hydrateVault);
}
function updateVault(id, fields) {
  const db = getDrizzle();
  const now = nowMs();
  const updates = { updated_at: now };
  if (fields.display_name !== void 0) {
    updates.name = fields.display_name;
  }
  if (fields.metadata !== void 0) {
    updates.metadata_json = JSON.stringify(fields.metadata);
  }
  db.update(schema_exports.vaults).set(updates).where(eq(schema_exports.vaults.id, id)).run();
  return getVault(id);
}
function archiveVault(id) {
  const db = getDrizzle();
  const res = db.update(schema_exports.vaults).set({ archived_at: nowMs() }).where(and(eq(schema_exports.vaults.id, id), isNull(schema_exports.vaults.archived_at))).run();
  return res.changes > 0;
}
function deleteVault(id) {
  const db = getDrizzle();
  const res = db.delete(schema_exports.vaults).where(eq(schema_exports.vaults.id, id)).run();
  return res.changes > 0;
}
function setEntry(vaultId, key, value) {
  const db = getDrizzle();
  const now = nowMs();
  const encrypted = encryptValue(value);
  db.insert(schema_exports.vaultEntries).values({ vault_id: vaultId, key, value: encrypted, updated_at: now }).onConflictDoUpdate({
    target: [schema_exports.vaultEntries.vault_id, schema_exports.vaultEntries.key],
    set: { value: encrypted, updated_at: now }
  }).run();
  db.update(schema_exports.vaults).set({ updated_at: now }).where(eq(schema_exports.vaults.id, vaultId)).run();
}
function getEntry(vaultId, key) {
  const db = getDrizzle();
  const row = db.select().from(schema_exports.vaultEntries).where(
    and(
      eq(schema_exports.vaultEntries.vault_id, vaultId),
      eq(schema_exports.vaultEntries.key, key)
    )
  ).get();
  return row ? { key: row.key, value: decryptValue(row.value) } : null;
}
function listEntries(vaultId) {
  const db = getDrizzle();
  const rows = db.select().from(schema_exports.vaultEntries).where(eq(schema_exports.vaultEntries.vault_id, vaultId)).orderBy(asc(schema_exports.vaultEntries.key)).all();
  return rows.map((r) => ({ key: r.key, value: decryptValue(r.value) }));
}
function deleteEntry(vaultId, key) {
  const db = getDrizzle();
  const res = db.delete(schema_exports.vaultEntries).where(
    and(
      eq(schema_exports.vaultEntries.vault_id, vaultId),
      eq(schema_exports.vaultEntries.key, key)
    )
  ).run();
  return res.changes > 0;
}

export {
  createVault,
  getVault,
  listVaults,
  updateVault,
  archiveVault,
  deleteVault,
  setEntry,
  getEntry,
  listEntries,
  deleteEntry
};
