@absolutejs/secrets 0.6.1 → 0.7.1

package/dist/broker.js

@@ -0,0 +1,825 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __require = import.meta.require;
+
+// node_modules/@absolutejs/telemetry/dist/index.js
+var NOOP_SPAN_CONTEXT = {
+  spanId: "0000000000000000",
+  traceFlags: 0,
+  traceId: "00000000000000000000000000000000"
+};
+var noopSpan = {
+  addEvent: () => noopSpan,
+  end: () => {},
+  isRecording: () => false,
+  recordException: () => {},
+  setAttribute: () => noopSpan,
+  setAttributes: () => noopSpan,
+  setStatus: () => noopSpan,
+  spanContext: () => NOOP_SPAN_CONTEXT,
+  updateName: () => noopSpan
+};
+var startActiveSpanNoop = (_name, optionsOrFn, maybeFn) => {
+  const fn = typeof optionsOrFn === "function" ? optionsOrFn : maybeFn;
+  return fn(noopSpan);
+};
+var noopTracer = {
+  startActiveSpan: startActiveSpanNoop,
+  startSpan: () => noopSpan
+};
+var tracerOrNoop = (provider, name, version) => provider !== undefined ? provider.getTracer(name, version) : noopTracer;
+var ABS_ATTRS = {
+  tenant: "abs.tenant",
+  shardId: "abs.shard.id",
+  engineId: "abs.engine.id",
+  collection: "abs.collection",
+  mutation: "abs.mutation",
+  mutationAttempt: "abs.mutation.attempt",
+  subscriptionId: "abs.subscription.id",
+  batchSize: "abs.batch.size",
+  clusterMessageOrigin: "abs.cluster.origin",
+  jobId: "abs.job.id",
+  jobKind: "abs.job.kind",
+  jobAttempt: "abs.job.attempt",
+  jobMaxAttempts: "abs.job.max_attempts",
+  workerId: "abs.worker.id",
+  runtimeKey: "abs.runtime.key",
+  runtimePid: "abs.runtime.pid",
+  runtimePort: "abs.runtime.port",
+  runtimeExitReason: "abs.runtime.exit_reason",
+  runtimeReadinessMs: "abs.runtime.readiness_ms",
+  routeShard: "abs.route.shard",
+  routeDecision: "abs.route.decision",
+  secretName: "abs.secret.name",
+  secretFingerprint: "abs.secret.fingerprint",
+  auditKind: "abs.audit.kind"
+};
+
+// src/broker.ts
+class BrokerDrainedError extends Error {
+  constructor() {
+    super("[secrets] Broker is draining \u2014 resolve/rotate refused. " + "Use the broker before the shutdown handler fires.");
+    this.name = "BrokerDrainedError";
+  }
+}
+var HEX = "0123456789abcdef";
+var sha256Hex = (input) => {
+  return sha256(input);
+};
+var ROUND_CONSTANTS = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var sha256 = (input) => {
+  const bytes = new TextEncoder().encode(input);
+  const bitLength = bytes.length * 8;
+  const padLength = (bytes.length + 9 + 63 & ~63) - bytes.length;
+  const padded = new Uint8Array(bytes.length + padLength);
+  padded.set(bytes);
+  padded[bytes.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 4, bitLength >>> 0);
+  view.setUint32(padded.length - 8, Math.floor(bitLength / 4294967296));
+  let h0 = 1779033703, h1 = 3144134277, h2 = 1013904242, h3 = 2773480762;
+  let h4 = 1359893119, h5 = 2600822924, h6 = 528734635, h7 = 1541459225;
+  const w = new Uint32Array(64);
+  for (let i = 0;i < padded.length; i += 64) {
+    for (let t = 0;t < 16; t++) {
+      w[t] = view.getUint32(i + t * 4);
+    }
+    for (let t = 16;t < 64; t++) {
+      const w15 = w[t - 15];
+      const w2 = w[t - 2];
+      const s0 = (w15 >>> 7 | w15 << 25) ^ (w15 >>> 18 | w15 << 14) ^ w15 >>> 3;
+      const s1 = (w2 >>> 17 | w2 << 15) ^ (w2 >>> 19 | w2 << 13) ^ w2 >>> 10;
+      w[t] = w[t - 16] + s0 + w[t - 7] + s1 >>> 0;
+    }
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+    for (let t = 0;t < 64; t++) {
+      const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
+      const ch = e & f ^ ~e & g;
+      const T1 = h + S1 + ch + ROUND_CONSTANTS[t] + w[t] >>> 0;
+      const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
+      const maj = a & b ^ a & c ^ b & c;
+      const T2 = S0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + T1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = T1 + T2 >>> 0;
+    }
+    h0 = h0 + a >>> 0;
+    h1 = h1 + b >>> 0;
+    h2 = h2 + c >>> 0;
+    h3 = h3 + d >>> 0;
+    h4 = h4 + e >>> 0;
+    h5 = h5 + f >>> 0;
+    h6 = h6 + g >>> 0;
+    h7 = h7 + h >>> 0;
+  }
+  const toHex = (n) => {
+    let result = "";
+    for (let i = 7;i >= 0; i--) {
+      result += HEX[n >>> i * 4 & 15];
+    }
+    return result;
+  };
+  return toHex(h0) + toHex(h1) + toHex(h2) + toHex(h3) + toHex(h4) + toHex(h5) + toHex(h6) + toHex(h7);
+};
+var fingerprintOf = (value) => sha256Hex(value).slice(0, 8);
+var randomBase36 = (length) => {
+  let out = "";
+  while (out.length < length) {
+    out += Math.random().toString(36).slice(2);
+  }
+  return out.slice(0, length);
+};
+var inMemoryAdapter = (options = {}) => {
+  const store = new Map;
+  for (const [k, v] of Object.entries(options.initial ?? {}))
+    store.set(k, v);
+  const rotate = options.rotate ?? (() => randomBase36(32));
+  return {
+    fetch: async (name) => store.get(name) ?? null,
+    list: async () => Array.from(store.keys()),
+    put: async (name, value) => {
+      store.set(name, value);
+    },
+    remove: async (name) => {
+      store.delete(name);
+    },
+    rotate: async (name) => {
+      const next = rotate(name, store.get(name) ?? null);
+      store.set(name, next);
+      return next;
+    }
+  };
+};
+var envAdapter = (options = {}) => {
+  const prefix = options.prefix ?? "";
+  const env = options.env ?? globalThis.process?.env ?? {};
+  return {
+    fetch: async (name) => {
+      const key = `${prefix}${name}`;
+      const value = env[key];
+      return value === undefined ? null : value;
+    },
+    list: async () => {
+      if (!prefix)
+        return Object.keys(env);
+      const matches = [];
+      for (const key of Object.keys(env)) {
+        if (key.startsWith(prefix))
+          matches.push(key.slice(prefix.length));
+      }
+      return matches;
+    }
+  };
+};
+var compositeAdapter = (adapters) => {
+  const firstWith = (method) => adapters.find((adapter) => adapter[method] !== undefined);
+  return {
+    fetch: async (name) => {
+      for (const adapter of adapters) {
+        const value = await adapter.fetch(name);
+        if (value !== null)
+          return value;
+      }
+      return null;
+    },
+    list: async () => {
+      const seen = new Set;
+      for (const adapter of adapters) {
+        if (!adapter.list)
+          continue;
+        for (const name of await adapter.list())
+          seen.add(name);
+      }
+      return Array.from(seen);
+    },
+    put: async (name, value) => {
+      const target = firstWith("put");
+      if (!target?.put)
+        throw new Error("No adapter in the composite supports put()");
+      await target.put(name, value);
+    },
+    remove: async (name) => {
+      const target = firstWith("remove");
+      if (!target?.remove)
+        throw new Error("No adapter in the composite supports remove()");
+      await target.remove(name);
+    },
+    rotate: async (name) => {
+      const target = firstWith("rotate");
+      if (!target?.rotate)
+        throw new Error("No adapter in the composite supports rotate()");
+      return target.rotate(name);
+    }
+  };
+};
+var DEFAULT_PBKDF2_ITERATIONS = 600000;
+var ENC_FILE_VERSION = 1;
+var SALT_BYTES = 16;
+var IV_BYTES = 12;
+var KEY_BYTES = 32;
+var bytesToBase64 = (bytes) => {
+  let bin = "";
+  for (const byte of bytes)
+    bin += String.fromCharCode(byte);
+  return btoa(bin);
+};
+var base64ToBytes = (b64) => {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i += 1)
+    out[i] = bin.charCodeAt(i);
+  return out;
+};
+var defaultIo = () => ({
+  readFile: async (path) => {
+    try {
+      const text = await (await import("fs/promises")).readFile(path, "utf8");
+      return text;
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+  },
+  writeFileAtomic: async (path, contents) => {
+    const fs = await import("fs/promises");
+    const tempPath = `${path}.tmp.${process.pid}`;
+    await fs.writeFile(tempPath, contents, { mode: 384 });
+    await fs.rename(tempPath, path);
+  }
+});
+var deriveKeyFromPassphrase = async (passphrase, salt, iterations) => {
+  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(passphrase), "PBKDF2", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey({
+    hash: "SHA-256",
+    iterations,
+    name: "PBKDF2",
+    salt
+  }, base, { length: 256, name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+};
+var importRawKey = async (bytes) => {
+  if (bytes.length !== KEY_BYTES) {
+    throw new Error(`[secrets/encrypted-file] raw key must be ${KEY_BYTES} bytes (got ${bytes.length})`);
+  }
+  return crypto.subtle.importKey("raw", bytes, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+};
+var encryptedFileAdapter = (options) => {
+  const io = options.io ?? defaultIo();
+  const iterations = options.pbkdf2Iterations ?? DEFAULT_PBKDF2_ITERATIONS;
+  const rotate = options.rotate ?? (() => randomBase36(32));
+  let cache;
+  let derivedKey;
+  let mutationQueue = Promise.resolve();
+  let salt;
+  const mutate = (operation) => {
+    const result = mutationQueue.then(operation, operation);
+    mutationQueue = result.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return result;
+  };
+  const ensureKey = async () => {
+    if (derivedKey !== undefined)
+      return derivedKey;
+    if (options.key.type === "raw") {
+      derivedKey = await importRawKey(options.key.bytes);
+      return derivedKey;
+    }
+    if (salt === undefined) {
+      salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+    }
+    derivedKey = await deriveKeyFromPassphrase(options.key.passphrase, salt, iterations);
+    return derivedKey;
+  };
+  const load = async () => {
+    if (cache !== undefined)
+      return cache;
+    const fileText = await io.readFile(options.path);
+    if (fileText === undefined) {
+      cache = new Map;
+      return cache;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(fileText);
+    } catch (error) {
+      throw new Error(`[secrets/encrypted-file] could not parse ${options.path}: ${error.message}`);
+    }
+    if (parsed.version !== ENC_FILE_VERSION) {
+      throw new Error(`[secrets/encrypted-file] unsupported file version ${parsed.version} in ${options.path}`);
+    }
+    if (parsed.kdf !== undefined) {
+      if (options.key.type !== "passphrase") {
+        throw new Error(`[secrets/encrypted-file] file was written with a passphrase but raw key was supplied`);
+      }
+      salt = base64ToBytes(parsed.kdf.salt);
+    } else if (options.key.type === "passphrase") {
+      throw new Error(`[secrets/encrypted-file] file was written with a raw key but passphrase was supplied`);
+    }
+    const key = await ensureKey();
+    const decoded = new Map;
+    for (const [name, entry] of Object.entries(parsed.values)) {
+      try {
+        const iv = base64ToBytes(entry.iv);
+        const ct = base64ToBytes(entry.ct);
+        const pt = await crypto.subtle.decrypt({ iv, name: "AES-GCM" }, key, ct);
+        decoded.set(name, new TextDecoder().decode(pt));
+      } catch {
+        throw new Error(`[secrets/encrypted-file] failed to decrypt "${name}" in ${options.path} \u2014 wrong master key or corrupted file`);
+      }
+    }
+    cache = decoded;
+    return cache;
+  };
+  const save = async () => {
+    const data = cache ?? new Map;
+    const key = await ensureKey();
+    const values = {};
+    for (const [name, value] of data) {
+      const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+      const ct = await crypto.subtle.encrypt({ iv, name: "AES-GCM" }, key, new TextEncoder().encode(value));
+      values[name] = {
+        ct: bytesToBase64(new Uint8Array(ct)),
+        iv: bytesToBase64(iv)
+      };
+    }
+    const file = {
+      values,
+      version: ENC_FILE_VERSION,
+      ...options.key.type === "passphrase" && salt !== undefined ? {
+        kdf: {
+          iterations,
+          salt: bytesToBase64(salt),
+          type: "pbkdf2-sha256"
+        }
+      } : {}
+    };
+    await io.writeFileAtomic(options.path, JSON.stringify(file, null, 2));
+  };
+  return {
+    fetch: async (name) => {
+      const data = await load();
+      return data.get(name) ?? null;
+    },
+    list: async () => {
+      const data = await load();
+      return Array.from(data.keys());
+    },
+    put: (name, value) => mutate(async () => {
+      const data = await load();
+      data.set(name, value);
+      await save();
+    }),
+    remove: (name) => mutate(async () => {
+      const data = await load();
+      data.delete(name);
+      await save();
+    }),
+    rotate: (name) => mutate(async () => {
+      const data = await load();
+      const previous = data.get(name) ?? null;
+      const next = rotate(name, previous);
+      data.set(name, next);
+      await save();
+      return next;
+    })
+  };
+};
+var rotateMasterKey = async (options) => {
+  const io = options.io ?? defaultIo();
+  const newIterations = options.newPbkdf2Iterations ?? DEFAULT_PBKDF2_ITERATIONS;
+  const fileText = await io.readFile(options.path);
+  if (fileText === undefined) {
+    throw new Error(`[secrets/encrypted-file] file ${options.path} does not exist`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fileText);
+  } catch (error) {
+    throw new Error(`[secrets/encrypted-file] could not parse ${options.path}: ${error.message}`);
+  }
+  if (parsed.version !== ENC_FILE_VERSION) {
+    throw new Error(`[secrets/encrypted-file] unsupported file version ${parsed.version} in ${options.path}`);
+  }
+  let oldDerivedKey;
+  if (options.oldKey.type === "raw") {
+    if (parsed.kdf !== undefined) {
+      throw new Error(`[secrets/encrypted-file] file was written with a passphrase but old key was supplied as raw`);
+    }
+    oldDerivedKey = await importRawKey(options.oldKey.bytes);
+  } else {
+    if (parsed.kdf === undefined) {
+      throw new Error(`[secrets/encrypted-file] file was written with a raw key but old key was supplied as passphrase`);
+    }
+    const oldSalt = base64ToBytes(parsed.kdf.salt);
+    oldDerivedKey = await deriveKeyFromPassphrase(options.oldKey.passphrase, oldSalt, parsed.kdf.iterations);
+  }
+  const decrypted = new Map;
+  for (const [name, entry] of Object.entries(parsed.values)) {
+    try {
+      const iv = base64ToBytes(entry.iv);
+      const ct = base64ToBytes(entry.ct);
+      const pt = await crypto.subtle.decrypt({ iv, name: "AES-GCM" }, oldDerivedKey, ct);
+      decrypted.set(name, new TextDecoder().decode(pt));
+    } catch {
+      throw new Error(`[secrets/encrypted-file] failed to decrypt "${name}" with old master key \u2014 wrong key or corrupted file`);
+    }
+  }
+  let newDerivedKey;
+  let newSalt;
+  if (options.newKey.type === "raw") {
+    newDerivedKey = await importRawKey(options.newKey.bytes);
+  } else {
+    newSalt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+    newDerivedKey = await deriveKeyFromPassphrase(options.newKey.passphrase, newSalt, newIterations);
+  }
+  const newValues = {};
+  for (const [name, value] of decrypted) {
+    const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+    const ct = await crypto.subtle.encrypt({ iv, name: "AES-GCM" }, newDerivedKey, new TextEncoder().encode(value));
+    newValues[name] = {
+      ct: bytesToBase64(new Uint8Array(ct)),
+      iv: bytesToBase64(iv)
+    };
+  }
+  const newFile = {
+    values: newValues,
+    version: ENC_FILE_VERSION,
+    ...options.newKey.type === "passphrase" && newSalt !== undefined ? {
+      kdf: {
+        iterations: newIterations,
+        salt: bytesToBase64(newSalt),
+        type: "pbkdf2-sha256"
+      }
+    } : {}
+  };
+  await io.writeFileAtomic(options.path, JSON.stringify(newFile, null, 2));
+};
+var createSecretBroker = (options) => {
+  const clock = options.clock ?? Date.now;
+  const defaultTtl = options.cacheTtlMs ?? 60000;
+  const ttlOverrides = options.cacheTtlOverrides ?? {};
+  const minLen = options.redactionMinLength ?? 8;
+  const encodings = options.redactionEncodings ?? ["plain"];
+  const audit = options.audit;
+  const cache = new Map;
+  const rotationListeners = new Map;
+  let disposed = false;
+  let draining = false;
+  const tracer = tracerOrNoop(options.tracerProvider, "@absolutejs/secrets");
+  const counters = {
+    invalidations: 0,
+    redactCalls: 0,
+    redactionsApplied: 0,
+    redactionsBase64: 0,
+    resolveErrors: 0,
+    resolveHits: 0,
+    resolveMisses: 0,
+    resolves: 0,
+    rotateErrors: 0,
+    rotates: 0
+  };
+  const ttlFor = (name) => ttlOverrides[name] ?? defaultTtl;
+  const fireRotation = (name, value, fingerprint, at) => {
+    const set = rotationListeners.get(name);
+    if (!set || set.size === 0)
+      return;
+    for (const listener of set) {
+      try {
+        const ret = listener({ at, fingerprint, name, value });
+        if (ret && typeof ret.then === "function") {
+          ret.catch((error) => {
+            console.error("[secrets] rotation listener rejected:", error);
+          });
+        }
+      } catch (error) {
+        console.error("[secrets] rotation listener threw:", error);
+      }
+    }
+  };
+  const fireAudit = (event) => {
+    if (!audit)
+      return;
+    try {
+      const result = audit(event);
+      if (result && typeof result.then === "function") {
+        result.catch((error) => {
+          console.error("[secrets] audit hook rejected:", error);
+        });
+      }
+    } catch (error) {
+      console.error("[secrets] audit hook threw:", error);
+    }
+  };
+  const cacheEntry = (name, value, now) => {
+    const entry = {
+      fingerprint: fingerprintOf(value),
+      storedAt: now,
+      value
+    };
+    cache.set(name, entry);
+    return entry;
+  };
+  const resolve = async (name) => {
+    if (disposed)
+      return null;
+    if (draining)
+      throw new BrokerDrainedError;
+    const span = tracer.startSpan("secrets.resolve", {
+      attributes: { [ABS_ATTRS.secretName]: name }
+    });
+    counters.resolves += 1;
+    const now = clock();
+    try {
+      const cached = cache.get(name);
+      if (cached && now - cached.storedAt < ttlFor(name)) {
+        counters.resolveHits += 1;
+        span.setAttribute(ABS_ATTRS.secretFingerprint, cached.fingerprint);
+        span.setAttribute("secrets.cache", "hit");
+        fireAudit({
+          at: now,
+          event: "resolve.hit",
+          fingerprint: cached.fingerprint,
+          name
+        });
+        span.setStatus({ code: 1 });
+        return { fingerprint: cached.fingerprint, value: cached.value };
+      }
+      counters.resolveMisses += 1;
+      span.setAttribute("secrets.cache", "miss");
+      const value = await options.adapter.fetch(name);
+      if (value === null) {
+        fireAudit({ at: now, event: "resolve.miss", name });
+        cache.delete(name);
+        span.setAttribute("secrets.found", false);
+        span.setStatus({ code: 1 });
+        return null;
+      }
+      const entry = cacheEntry(name, value, now);
+      span.setAttribute(ABS_ATTRS.secretFingerprint, entry.fingerprint);
+      fireAudit({
+        at: now,
+        event: "resolve.miss",
+        fingerprint: entry.fingerprint,
+        name
+      });
+      span.setStatus({ code: 1 });
+      return { fingerprint: entry.fingerprint, value: entry.value };
+    } catch (error) {
+      counters.resolveErrors += 1;
+      fireAudit({
+        at: now,
+        error: error instanceof Error ? error.message : String(error),
+        event: "resolve.error",
+        name
+      });
+      span.recordException(error);
+      span.setStatus({
+        code: 2,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    } finally {
+      span.end();
+    }
+  };
+  const rotate = async (name) => {
+    if (disposed)
+      throw new Error("Broker is disposed");
+    if (draining)
+      throw new BrokerDrainedError;
+    if (!options.adapter.rotate) {
+      throw new Error("Adapter does not support rotate()");
+    }
+    const span = tracer.startSpan("secrets.rotate", {
+      attributes: { [ABS_ATTRS.secretName]: name }
+    });
+    try {
+      const next = await options.adapter.rotate(name);
+      const now = clock();
+      const entry = cacheEntry(name, next, now);
+      counters.rotates += 1;
+      span.setAttribute(ABS_ATTRS.secretFingerprint, entry.fingerprint);
+      span.setStatus({ code: 1 });
+      fireAudit({
+        at: now,
+        event: "rotate",
+        fingerprint: entry.fingerprint,
+        name
+      });
+      fireRotation(name, entry.value, entry.fingerprint, now);
+      return { fingerprint: entry.fingerprint, value: entry.value };
+    } catch (error) {
+      counters.rotateErrors += 1;
+      span.recordException(error);
+      span.setStatus({
+        code: 2,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    } finally {
+      span.end();
+    }
+  };
+  const invalidate = (name) => {
+    if (name === undefined) {
+      cache.clear();
+    } else {
+      cache.delete(name);
+    }
+    counters.invalidations += 1;
+    fireAudit({ at: clock(), event: "invalidate", name: name ?? null });
+  };
+  const redactionPairs = () => {
+    const pairs = [];
+    for (const [name, entry] of cache) {
+      if (entry.value.length < minLen)
+        continue;
+      for (const enc of encodings) {
+        if (enc === "plain") {
+          pairs.push([entry.value, `[REDACTED:${name}]`]);
+        } else if (enc === "base64") {
+          try {
+            const encoded = btoa(entry.value);
+            if (encoded.length >= minLen) {
+              pairs.push([encoded, `[REDACTED:${name}:b64]`]);
+            }
+          } catch {}
+        }
+      }
+    }
+    pairs.sort((a, b) => b[0].length - a[0].length);
+    return pairs;
+  };
+  const redact = (text) => {
+    counters.redactCalls += 1;
+    if (text.length === 0 || cache.size === 0)
+      return text;
+    let out = text;
+    for (const [needle, replacement] of redactionPairs()) {
+      if (!out.includes(needle))
+        continue;
+      out = out.split(needle).join(replacement);
+      counters.redactionsApplied += 1;
+      if (replacement.endsWith(":b64]"))
+        counters.redactionsBase64 += 1;
+    }
+    return out;
+  };
+  const redactStream = () => {
+    let buffer = "";
+    const maxLen = () => redactionPairs().reduce((max, [needle]) => Math.max(max, needle.length), 0);
+    return new TransformStream({
+      transform: (chunk, controller) => {
+        buffer += chunk;
+        const lookback = maxLen();
+        const reduced = redact(buffer);
+        if (reduced.length <= lookback) {
+          buffer = reduced;
+          return;
+        }
+        const safe = reduced.slice(0, reduced.length - lookback);
+        buffer = reduced.slice(reduced.length - lookback);
+        if (safe.length > 0)
+          controller.enqueue(safe);
+      },
+      flush: (controller) => {
+        if (buffer.length === 0)
+          return;
+        controller.enqueue(redact(buffer));
+        buffer = "";
+      }
+    });
+  };
+  const onRotate = (name, listener) => {
+    let set = rotationListeners.get(name);
+    if (!set) {
+      set = new Set;
+      rotationListeners.set(name, set);
+    }
+    set.add(listener);
+    return () => {
+      const current = rotationListeners.get(name);
+      if (!current)
+        return;
+      current.delete(listener);
+      if (current.size === 0)
+        rotationListeners.delete(name);
+    };
+  };
+  return {
+    dispose: () => {
+      disposed = true;
+      cache.clear();
+      rotationListeners.clear();
+    },
+    drain: () => {
+      draining = true;
+    },
+    fingerprint: fingerprintOf,
+    invalidate,
+    metrics: () => ({ ...counters }),
+    onRotate,
+    redact,
+    redactStream,
+    resolve,
+    rotate
+  };
+};
+export {
+  rotateMasterKey,
+  inMemoryAdapter,
+  envAdapter,
+  encryptedFileAdapter,
+  createSecretBroker,
+  compositeAdapter,
+  BrokerDrainedError
+};
+
+//# debugId=C0F1FD10B1D73AB064756E2164756E21
+//# sourceMappingURL=broker.js.map