# bex-api's per-service secret-files surface (backend/internal/secrets/files.go,
# docs/ADR006-bex-api.md). Files nest under the service, Render-dashboard-shaped, mirroring
# env vars: `secretFileNames` lists names only (each with an id == name); a file's
# contents are fetched per name via `secretFile(name)` ("Show contents"), never in
# the bulk list. Mutations are top-level and return a success boolean.

query SecretFileNames($id: String!) {
  service(id: $id) {
    id
    secretFileNames {
      id
      name
    }
  }
}

query SecretFileContent($id: String!, $name: String!) {
  service(id: $id) {
    id
    secretFile(name: $name) {
      id
      name
      content
    }
  }
}

mutation SetSecretFile($serviceId: String!, $name: String!, $content: String) {
  setSecretFile(serviceId: $serviceId, name: $name, content: $content)
}

mutation DeleteSecretFile($serviceId: String!, $name: String!) {
  deleteSecretFile(serviceId: $serviceId, name: $name)
}
