/**
 * SQLite Cloud Provider Tokens Repository
 *
 * Implements ICloudProviderTokensRepository using better-sqlite3.
 * Encrypts tokens with LocalSecretBox before persisting, decrypts on read.
 */
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
import { injectable } from 'tsyringe';
import { LocalSecretBox } from '../services/crypto/local-secret-box.js';
let SQLiteCloudProviderTokensRepository = class SQLiteCloudProviderTokensRepository {
    db;
    secretBox;
    constructor(db, secretBox) {
        this.db = db;
        this.secretBox = secretBox;
    }
    async get(provider) {
        const row = this.db
            .prepare('SELECT provider, token_ciphertext, token_iv, token_tag, created_at, updated_at FROM cloud_provider_tokens WHERE provider = ?')
            .get(provider);
        if (!row)
            return null;
        return this.secretBox.decrypt({
            ciphertext: row.token_ciphertext,
            iv: row.token_iv,
            tag: row.token_tag,
        });
    }
    async set(provider, token) {
        const now = Date.now();
        const blob = this.secretBox.encrypt(token);
        const stmt = this.db.prepare(`
      INSERT INTO cloud_provider_tokens (
        provider, token_ciphertext, token_iv, token_tag, created_at, updated_at
      ) VALUES (
        @provider, @token_ciphertext, @token_iv, @token_tag, @created_at, @updated_at
      )
      ON CONFLICT(provider) DO UPDATE SET
        token_ciphertext = excluded.token_ciphertext,
        token_iv = excluded.token_iv,
        token_tag = excluded.token_tag,
        updated_at = excluded.updated_at
    `);
        stmt.run({
            provider,
            token_ciphertext: blob.ciphertext,
            token_iv: blob.iv,
            token_tag: blob.tag,
            created_at: now,
            updated_at: now,
        });
    }
    async remove(provider) {
        this.db.prepare('DELETE FROM cloud_provider_tokens WHERE provider = ?').run(provider);
    }
    async listConnected() {
        const rows = this.db
            .prepare('SELECT provider FROM cloud_provider_tokens')
            .all();
        return rows.map((r) => r.provider);
    }
};
SQLiteCloudProviderTokensRepository = __decorate([
    injectable(),
    __metadata("design:paramtypes", [Object, LocalSecretBox])
], SQLiteCloudProviderTokensRepository);
export { SQLiteCloudProviderTokensRepository };
