@capsara/sdk 1.0.1

package/dist/internal/decryptor/capsa-decryptor.js

@@ -0,0 +1,263 @@
+/** Capsa decryption utilities for client-side decryption of API responses. */
+import * as crypto from 'crypto';
+import { decryptAES, decryptMasterKey } from '../crypto/primitives.js';
+import { buildCanonicalString, verifyCapsaSignature } from '../crypto/signatures.js';
+import { decompressData } from '../crypto/compression.js';
+function findKeychainEntry(capsa, partyId) {
+    return capsa.keychain.keys.find((key) => key.party === partyId) || null;
+}
+function findDelegateEntry(capsa, partyId) {
+    return (capsa.keychain.keys.find((key) => key.actingFor && key.actingFor.includes(partyId)) || null);
+}
+/**
+ * Decrypt capsa using party's private key
+ *
+ * SECURITY FEATURES:
+ * - Verifies capsa signature before decryption
+ * - Requires auth tags for all AES-GCM decryption
+ * - Validates keychain entry exists
+ *
+ * NOTE: partyId is optional. If not provided, uses the first keychain entry
+ * (which is the authenticated party's key when retrieved from API).
+ *
+ * @param capsa - Encrypted capsa from API
+ * @param privateKey - Party's RSA private key in PEM format
+ * @param partyId - Party ID (optional - auto-detected from keychain if omitted)
+ * @param creatorPublicKey - Creator's RSA public key in PEM format (for signature verification)
+ * @param verifySignature - Whether to verify signature (default: true, set false to skip)
+ * @returns Decrypted capsa data
+ * @throws Error if signature invalid, party not in keychain, or decryption fails
+ */
+export function decryptCapsa(capsa, privateKey, partyId, creatorPublicKey, verifySignature = true) {
+    // SECURITY: Verify capsa signature before decrypting
+    if (verifySignature) {
+        if (!creatorPublicKey) {
+            throw new Error('creatorPublicKey is required for signature verification. Pass verifySignature=false to skip (not recommended).');
+        }
+        // SECURITY VALIDATION: Verify signature object exists with required fields
+        if (!capsa.signature || typeof capsa.signature !== 'object' || !capsa.signature.signature) {
+            throw new Error(`Capsa signature is missing or invalid (capsa: ${capsa.id}). Capsa may be corrupted or created with an old SDK version.`);
+        }
+        // Validate signature format (RSA-SHA256 produces 512-byte signature, base64url-encoded)
+        try {
+            const signatureBuffer = Buffer.from(capsa.signature.signature, 'base64url');
+            if (signatureBuffer.length !== 512) {
+                throw new Error(`Signature length validation failed: expected 512 bytes (RSA-4096-SHA256), got ${signatureBuffer.length} bytes (capsa: ${capsa.id}). Possible data corruption.`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('Signature length validation')) {
+                throw error;
+            }
+            throw new Error(`Signature format validation failed: invalid base64url encoding (capsa: ${capsa.id}).`);
+        }
+        if (!creatorPublicKey.includes('BEGIN') || !creatorPublicKey.includes('PUBLIC KEY')) {
+            throw new Error(`Creator public key format validation failed: missing PEM headers (creator: ${capsa.creator}).`);
+        }
+        // Build canonical string from capsa data (createdAt excluded - not part of signature)
+        const canonicalString = buildCanonicalString({
+            packageId: capsa.id,
+            totalSize: capsa.totalSize,
+            algorithm: capsa.keychain.algorithm,
+            files: capsa.files,
+            structuredIV: capsa.structuredIV,
+            subjectIV: capsa.subjectIV,
+            bodyIV: capsa.bodyIV,
+        });
+        const signatureValid = verifyCapsaSignature(capsa.signature, canonicalString, creatorPublicKey);
+        if (!signatureValid) {
+            throw new Error(`Signature verification failed: capsa data does not match signature (capsa: ${capsa.id}, creator: ${capsa.creator}). Capsa may have been tampered with or corrupted.`);
+        }
+    }
+    let keychainEntry;
+    if (partyId) {
+        const foundEntry = findKeychainEntry(capsa, partyId);
+        if (!foundEntry) {
+            const delegateEntry = findDelegateEntry(capsa, partyId);
+            if (!delegateEntry) {
+                throw new Error(`Party ${partyId} not found in capsa keychain. Cannot decrypt.`);
+            }
+            keychainEntry = delegateEntry;
+        }
+        else {
+            keychainEntry = foundEntry;
+        }
+    }
+    else {
+        // No partyId - use first keychain entry (API returns only authenticated party's key)
+        if (!capsa.keychain.keys || capsa.keychain.keys.length === 0) {
+            throw new Error('No keychain entries found in capsa. Cannot decrypt.');
+        }
+        const firstEntry = capsa.keychain.keys[0];
+        if (!firstEntry) {
+            throw new Error('First keychain entry is undefined. Cannot decrypt.');
+        }
+        keychainEntry = firstEntry;
+    }
+    if (!keychainEntry.encryptedKey) {
+        const partyInfo = partyId || keychainEntry.party;
+        throw new Error(`Party ${partyInfo} has no encrypted key in keychain. This party may be a delegated recipient without direct access.`);
+    }
+    // SECURITY VALIDATION: Verify encrypted key format and integrity
+    // RSA-4096-OAEP outputs exactly 512 bytes, base64url-encoded
+    const encryptedKeyBuffer = Buffer.from(keychainEntry.encryptedKey, 'base64url');
+    if (encryptedKeyBuffer.length !== 512) {
+        throw new Error(`Encrypted key length validation failed: expected 512 bytes (RSA-4096), got ${encryptedKeyBuffer.length} bytes (capsa: ${capsa.id}, party: ${partyId || keychainEntry.party}). Possible data corruption.`);
+    }
+    if (!privateKey || typeof privateKey !== 'string') {
+        throw new Error('Private key is invalid or missing');
+    }
+    if (!privateKey.includes('BEGIN') || !privateKey.includes('PRIVATE KEY')) {
+        throw new Error(`Private key format validation failed: missing PEM headers. Key may be corrupted.`);
+    }
+    let masterKey;
+    try {
+        masterKey = decryptMasterKey(keychainEntry.encryptedKey, privateKey);
+    }
+    catch (error) {
+        // Preserve original error details for diagnostics
+        const originalMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`RSA master key decryption failed: ${originalMessage} (capsa: ${capsa.id}, party: ${partyId || keychainEntry.party}, encryptedKeyLength: ${encryptedKeyBuffer.length})`);
+    }
+    // SECURITY VALIDATION: Verify decrypted master key is correct size
+    // AES-256 requires exactly 32 bytes
+    if (masterKey.length !== 32) {
+        throw new Error(`Master key size validation failed: expected 32 bytes (AES-256), got ${masterKey.length} bytes. RSA decryption may have succeeded with wrong key.`);
+    }
+    let subject;
+    let body;
+    let structured;
+    if (capsa.encryptedSubject && capsa.subjectIV) {
+        if (!capsa.subjectAuthTag) {
+            // eslint-disable-next-line no-console
+            console.warn('WARNING: encryptedSubject missing authTag - skipping decryption for security');
+        }
+        else {
+            const subjectBuffer = decryptAES(capsa.encryptedSubject, masterKey, capsa.subjectIV, capsa.subjectAuthTag);
+            subject = subjectBuffer.toString('utf-8');
+        }
+    }
+    if (capsa.encryptedBody && capsa.bodyIV) {
+        if (!capsa.bodyAuthTag) {
+            // eslint-disable-next-line no-console
+            console.warn('WARNING: encryptedBody missing authTag - skipping decryption for security');
+        }
+        else {
+            const bodyBuffer = decryptAES(capsa.encryptedBody, masterKey, capsa.bodyIV, capsa.bodyAuthTag);
+            body = bodyBuffer.toString('utf-8');
+        }
+    }
+    if (capsa.encryptedStructured && capsa.structuredIV) {
+        if (!capsa.structuredAuthTag) {
+            // eslint-disable-next-line no-console
+            console.warn('WARNING: encryptedStructured missing authTag - skipping decryption for security');
+        }
+        else {
+            const structuredBuffer = decryptAES(capsa.encryptedStructured, masterKey, capsa.structuredIV, capsa.structuredAuthTag);
+            structured = JSON.parse(structuredBuffer.toString('utf-8'));
+        }
+    }
+    // Map soft_deleted to expired for SDK consumers (soft_deleted is internal server status)
+    const status = capsa.status === 'soft_deleted' ? 'expired' :
+        capsa.status === 'expired' ? 'expired' : 'active';
+    const decryptedCapsa = {
+        id: capsa.id,
+        creator: capsa.creator,
+        createdAt: capsa.createdAt,
+        updatedAt: capsa.updatedAt,
+        status,
+        subject,
+        body,
+        structured,
+        files: capsa.files,
+        accessControl: capsa.accessControl,
+        keychain: capsa.keychain,
+        signature: capsa.signature,
+        metadata: capsa.metadata,
+        stats: {
+            totalSize: capsa.totalSize,
+            fileCount: capsa.files?.length ?? 0,
+        },
+        _encrypted: capsa,
+        _masterKey: masterKey, // Placeholder, will be redefined as non-enumerable
+        clearMasterKey: function () {
+            // Implementation added below
+        }
+    };
+    // Non-enumerable to prevent serialization
+    Object.defineProperty(decryptedCapsa, '_masterKey', {
+        value: masterKey,
+        enumerable: false, // Hidden from enumeration
+        writable: false, // Immutable
+        configurable: true // Allow clearMasterKey() to replace with zeroed buffer
+    });
+    decryptedCapsa.clearMasterKey = function () {
+        if (this._masterKey && this._masterKey.length > 0) {
+            // Overwrite master key buffer with cryptographically random data
+            crypto.randomFillSync(this._masterKey);
+            Object.defineProperty(this, '_masterKey', {
+                value: Buffer.alloc(0),
+                enumerable: false,
+                writable: false,
+                configurable: false // Lock down after clearing
+            });
+        }
+    };
+    return decryptedCapsa;
+}
+/**
+ * Decrypt a file from a capsa
+ *
+ * SECURITY: Requires non-empty authTag for AES-GCM integrity verification
+ *
+ * @param encryptedFileData - Encrypted file data (base64url)
+ * @param masterKey - Decrypted master key
+ * @param iv - Initialization vector for file
+ * @param authTag - Authentication tag for file (REQUIRED)
+ * @returns Decrypted file buffer
+ * @throws Error if authTag is missing or decryption fails
+ */
+export async function decryptFile(encryptedFileData, masterKey, iv, authTag, compressed) {
+    // SECURITY: Validate authTag is present
+    if (!authTag || authTag.trim() === '') {
+        throw new Error('SECURITY ERROR: authTag is required for file decryption. Missing authTag indicates potential tampering.');
+    }
+    try {
+        const decryptedData = decryptAES(encryptedFileData, masterKey, iv, authTag);
+        if (compressed) {
+            return await decompressData(decryptedData);
+        }
+        return decryptedData;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        throw new Error(`Failed to decrypt file: ${message}`);
+    }
+}
+/**
+ * Decrypt filename from capsa
+ *
+ * SECURITY: Requires non-empty authTag for AES-GCM integrity verification
+ *
+ * @param encryptedFilename - Encrypted filename (base64url)
+ * @param masterKey - Decrypted master key
+ * @param iv - Initialization vector for filename
+ * @param authTag - Authentication tag for filename (REQUIRED)
+ * @returns Decrypted filename
+ * @throws Error if authTag is missing or decryption fails
+ */
+export function decryptFilename(encryptedFilename, masterKey, iv, authTag) {
+    // SECURITY: Validate authTag is present
+    if (!authTag || authTag.trim() === '') {
+        throw new Error('SECURITY ERROR: authTag is required for filename decryption. Missing authTag indicates potential tampering.');
+    }
+    try {
+        const filenameBuffer = decryptAES(encryptedFilename, masterKey, iv, authTag);
+        return filenameBuffer.toString('utf-8');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        throw new Error(`Failed to decrypt filename: ${message}`);
+    }
+}
+//# sourceMappingURL=capsa-decryptor.js.map

package/dist/internal/decryptor/capsa-decryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capsa-decryptor.js","sourceRoot":"","sources":["../../../src/internal/decryptor/capsa-decryptor.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AA8D1D,SAAS,iBAAiB,CACxB,KAAY,EACZ,OAAe;IAEf,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AACzF,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAY,EACZ,OAAe;IAEf,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CACtB,CAAC,GAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CACzE,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAY,EACZ,UAAkB,EAClB,OAAgB,EAChB,gBAAyB,EACzB,eAAe,GAAG,IAAI;IAEtB,qDAAqD;IACrD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,CAAC,EAAE,+DAA+D,CACzH,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,iFAAiF,eAAe,CAAC,MAAM,kBAAkB,KAAK,CAAC,EAAE,8BAA8B,CAChK,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACpF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0EAA0E,KAAK,CAAC,EAAE,IAAI,CACvF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,8EAA8E,KAAK,CAAC,OAAO,IAAI,CAChG,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,SAAS,EAAE,KAAK,CAAC,EAAE;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,oBAAoB,CACzC,KAAK,CAAC,SAAS,EACf,eAAe,EACf,gBAAgB,CACjB,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,8EAA8E,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,OAAO,oDAAoD,CACtK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,aAA4B,CAAC;IAEjC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,+CAA+C,CAChE,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,aAAa,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qFAAqF;QACrF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,aAAa,GAAG,UAAU,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,mGAAmG,CACtH,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,kBAAkB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8EAA8E,kBAAkB,CAAC,MAAM,kBAAkB,KAAK,CAAC,EAAE,YAAY,OAAO,IAAI,aAAa,CAAC,KAAK,8BAA8B,CAC1M,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kDAAkD;QAClD,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,qCAAqC,eAAe,YAAY,KAAK,CAAC,EAAE,YAAY,OAAO,IAAI,aAAa,CAAC,KAAK,yBAAyB,kBAAkB,CAAC,MAAM,GAAG,CACxK,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,oCAAoC;IACpC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uEAAuE,SAAS,CAAC,MAAM,2DAA2D,CACnJ,CAAC;IACJ,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,IAAwB,CAAC;IAC7B,IAAI,UAA+C,CAAC;IAEpD,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,8EAA8E,CAC/E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,UAAU,CAC9B,KAAK,CAAC,gBAAgB,EACtB,SAAS,EACT,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,2EAA2E,CAC5E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,UAAU,CAC3B,KAAK,CAAC,aAAa,EACnB,SAAS,EACT,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,WAAW,CAClB,CAAC;YACF,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,iFAAiF,CAClF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,GAAG,UAAU,CACjC,KAAK,CAAC,mBAAmB,EACzB,SAAS,EACT,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,iBAAiB,CACxB,CAAC;YACF,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAGzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpD,MAAM,cAAc,GAAmB;QACrC,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM;QACN,OAAO;QACP,IAAI;QACJ,UAAU;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;SACpC;QACD,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,SAAS,EAAE,mDAAmD;QAC1E,cAAc,EAAE;YACd,6BAA6B;QAC/B,CAAC;KACF,CAAC;IAEF,0CAA0C;IAC1C,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,YAAY,EAAE;QAClD,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,KAAK,EAAI,0BAA0B;QAC/C,QAAQ,EAAE,KAAK,EAAM,YAAY;QACjC,YAAY,EAAE,IAAI,CAAG,uDAAuD;KAC7E,CAAC,CAAC;IAEH,cAAc,CAAC,cAAc,GAAG;QAC9B,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,iEAAiE;YACjE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE;gBACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtB,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK,CAAE,2BAA2B;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,iBAAyB,EACzB,SAAiB,EACjB,EAAU,EACV,OAAe,EACf,UAAoB;IAEpB,wCAAwC;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,UAAU,CAAC,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAE5E,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,iBAAyB,EACzB,SAAiB,EACjB,EAAU,EACV,OAAe;IAEf,wCAAwC;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,UAAU,CAAC,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/internal/http-factory.d.ts

@@ -0,0 +1,78 @@
+/**
+ * HTTP client factory - eliminates HTTP setup duplication across services
+ * @file capsara.sdk/typescript/src/internal/http-factory.ts
+ */
+import { AxiosInstance } from 'axios';
+import * as http from 'http';
+import * as https from 'https';
+import type { RetryConfig } from './config/retry-interceptor.js';
+/**
+ * HTTP client timeout configuration
+ */
+export interface HttpTimeoutConfig {
+    /** Timeout for standard API requests (ms) */
+    apiTimeout: number;
+    /** Timeout for multipart envelope uploads (ms) */
+    uploadTimeout: number;
+    /** Timeout for file downloads (ms) */
+    downloadTimeout: number;
+    /** Socket connection timeout (ms) */
+    connectTimeout: number;
+    /** Keep-alive probe interval (ms) */
+    keepAliveInterval: number;
+    /** Maximum concurrent sockets per host */
+    maxSockets: number;
+    /** Maximum idle sockets to keep alive */
+    maxFreeSockets: number;
+}
+/**
+ * Default timeout configuration
+ *
+ * CRITICAL: SDK timeouts must EXCEED server timeouts to prevent ECONNRESET errors
+ *
+ * vault.api server timeouts:
+ * - Server request timeout: 10 minutes
+ * - Server keepAlive: 11 minutes
+ * - MongoDB socket timeout: 30 seconds
+ * - Circuit breaker timeout: 30 seconds
+ */
+export declare const DEFAULT_TIMEOUT_CONFIG: HttpTimeoutConfig;
+/**
+ * Options for creating an HTTP client
+ */
+export interface HttpClientOptions {
+    /** API base URL */
+    baseUrl: string;
+    /** Timeout configuration */
+    timeout?: Partial<HttpTimeoutConfig>;
+    /** Retry configuration */
+    retry?: RetryConfig;
+    /** Function to get auth token (for authenticated requests) */
+    getToken?: () => string | null;
+    /** Custom user agent string to append to default SDK user agent */
+    userAgent?: string;
+}
+/**
+ * Logger interface for retry interceptor
+ */
+export interface RetryLogger {
+    log: (message: string) => void;
+}
+/**
+ * Create a configured axios instance with retry and optional auth
+ *
+ * This factory eliminates the HTTP setup duplication found in AuthClient,
+ * KeyManager, LimitsManager, AccountClient, and CapsaraClient.
+ *
+ * @param options - HTTP client configuration
+ * @returns Configured axios instance
+ */
+export declare function createHttpClient(options: HttpClientOptions): AxiosInstance;
+/**
+ * Create HTTP/HTTPS agent for raw requests with custom timeout
+ * @param protocol - 'http:' or 'https:'
+ * @param timeout - Request timeout in milliseconds
+ * @param config - Timeout configuration
+ */
+export declare function createAgentForProtocol(protocol: string, timeout: number, config?: HttpTimeoutConfig): http.Agent | https.Agent;
+//# sourceMappingURL=http-factory.d.ts.map

package/dist/internal/http-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-factory.d.ts","sourceRoot":"","sources":["../../src/internal/http-factory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAc,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAQpC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4BD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AA0HD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,CAgC1E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,iBAA0C,GACjD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAY1B"}

package/dist/internal/http-factory.js

@@ -0,0 +1,201 @@
+/**
+ * HTTP client factory - eliminates HTTP setup duplication across services
+ * @file capsara.sdk/typescript/src/internal/http-factory.ts
+ */
+import axios from 'axios';
+import * as http from 'http';
+import * as https from 'https';
+import { SDK_VERSION, buildUserAgent } from './version.js';
+/**
+ * Default timeout configuration
+ *
+ * CRITICAL: SDK timeouts must EXCEED server timeouts to prevent ECONNRESET errors
+ *
+ * vault.api server timeouts:
+ * - Server request timeout: 10 minutes
+ * - Server keepAlive: 11 minutes
+ * - MongoDB socket timeout: 30 seconds
+ * - Circuit breaker timeout: 30 seconds
+ */
+export const DEFAULT_TIMEOUT_CONFIG = {
+    apiTimeout: 12 * 60 * 1000, // 12 minutes (exceeds server 10 min timeout)
+    uploadTimeout: 15 * 60 * 1000, // 15 minutes for multipart uploads
+    downloadTimeout: 60 * 1000, // 1 minute for file downloads
+    connectTimeout: 30 * 1000, // 30 seconds for socket connection
+    keepAliveInterval: 30 * 1000, // 30 seconds keep-alive probe interval
+    maxSockets: 50, // Max 50 concurrent sockets per host
+    maxFreeSockets: 10, // Keep 10 idle sockets alive
+};
+/**
+ * Create HTTP agent with keep-alive and timeout configuration
+ */
+function createHttpAgent(config) {
+    return new http.Agent({
+        keepAlive: true,
+        keepAliveMsecs: config.keepAliveInterval,
+        timeout: config.apiTimeout,
+        maxSockets: config.maxSockets,
+        maxFreeSockets: config.maxFreeSockets,
+    });
+}
+/**
+ * Create HTTPS agent with keep-alive and timeout configuration
+ */
+function createHttpsAgent(config) {
+    return new https.Agent({
+        keepAlive: true,
+        keepAliveMsecs: config.keepAliveInterval,
+        timeout: config.apiTimeout,
+        maxSockets: config.maxSockets,
+        maxFreeSockets: config.maxFreeSockets,
+    });
+}
+/**
+ * Default retry configuration
+ */
+const DEFAULT_RETRY_CONFIG = {
+    maxRetries: 3,
+    baseDelay: 1000,
+    maxDelay: 30000,
+    enableLogging: false,
+    // eslint-disable-next-line no-console
+    logger: { log: (msg) => console.log(msg) },
+};
+/**
+ * Calculate retry delay using exponential backoff
+ */
+function calculateExponentialBackoff(retryCount, baseDelay, maxDelay) {
+    const exponentialDelay = baseDelay * Math.pow(2, retryCount);
+    const jitter = Math.random() * 0.3 * exponentialDelay;
+    return Math.min(Math.floor(exponentialDelay + jitter), maxDelay);
+}
+/**
+ * Sleep for specified duration
+ */
+function sleep(ms) {
+    return new Promise(resolve => globalThis.setTimeout(resolve, ms));
+}
+/**
+ * Check if error is retryable (503 or 429)
+ */
+function isRetryableStatus(status) {
+    return status === 503 || status === 429;
+}
+/**
+ * Extract retry delay from server response
+ */
+function getServerSuggestedDelay(response) {
+    // Check response body for retryAfter field
+    const data = response.data;
+    if (data?.error?.retryAfter && typeof data.error.retryAfter === 'number') {
+        return data.error.retryAfter * 1000;
+    }
+    // Check Retry-After header
+    const retryAfter = response.headers?.['retry-after'];
+    if (retryAfter) {
+        const seconds = parseInt(retryAfter, 10);
+        if (!isNaN(seconds)) {
+            return seconds * 1000;
+        }
+        const date = new Date(retryAfter);
+        if (!isNaN(date.getTime())) {
+            const delay = date.getTime() - Date.now();
+            return delay > 0 ? delay : 0;
+        }
+    }
+    return null;
+}
+/**
+ * Add retry interceptor to axios instance
+ */
+function addRetryInterceptor(axiosInstance, config = {}) {
+    const retryConfig = { ...DEFAULT_RETRY_CONFIG, ...config };
+    axiosInstance.interceptors.response.use((response) => response, async (error) => {
+        // Type guard for axios error structure
+        const axiosError = error;
+        const requestConfig = axiosError.config;
+        if (!requestConfig) {
+            return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+        if (requestConfig.__retryCount === undefined) {
+            requestConfig.__retryCount = 0;
+        }
+        const status = axiosError.response?.status;
+        if (!status || !isRetryableStatus(status) || requestConfig.__retryCount >= retryConfig.maxRetries) {
+            return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+        requestConfig.__retryCount++;
+        let retryDelay;
+        const serverDelay = axiosError.response ? getServerSuggestedDelay(axiosError.response) : null;
+        if (serverDelay !== null) {
+            retryDelay = Math.min(serverDelay, retryConfig.maxDelay);
+            if (retryConfig.enableLogging) {
+                retryConfig.logger.log(`[Capsara SDK] Retry ${requestConfig.__retryCount}/${retryConfig.maxRetries} for ${status} - waiting ${retryDelay}ms (server suggested)`);
+            }
+        }
+        else {
+            retryDelay = calculateExponentialBackoff(requestConfig.__retryCount - 1, retryConfig.baseDelay, retryConfig.maxDelay);
+            if (retryConfig.enableLogging) {
+                retryConfig.logger.log(`[Capsara SDK] Retry ${requestConfig.__retryCount}/${retryConfig.maxRetries} for ${status} - waiting ${retryDelay}ms (exponential backoff)`);
+            }
+        }
+        await sleep(retryDelay);
+        return axiosInstance.request(requestConfig);
+    });
+}
+/**
+ * Create a configured axios instance with retry and optional auth
+ *
+ * This factory eliminates the HTTP setup duplication found in AuthClient,
+ * KeyManager, LimitsManager, AccountClient, and CapsaraClient.
+ *
+ * @param options - HTTP client configuration
+ * @returns Configured axios instance
+ */
+export function createHttpClient(options) {
+    const timeoutConfig = { ...DEFAULT_TIMEOUT_CONFIG, ...options.timeout };
+    const axiosConfig = {
+        baseURL: options.baseUrl,
+        timeout: timeoutConfig.apiTimeout,
+        httpAgent: createHttpAgent(timeoutConfig),
+        httpsAgent: createHttpsAgent(timeoutConfig),
+        headers: {
+            'User-Agent': buildUserAgent(options.userAgent),
+            'X-SDK-Version': SDK_VERSION,
+        },
+    };
+    const axiosInstance = axios.create(axiosConfig);
+    // Add retry interceptor
+    addRetryInterceptor(axiosInstance, options.retry);
+    // Add auth interceptor if token getter provided
+    if (options.getToken) {
+        const getToken = options.getToken;
+        axiosInstance.interceptors.request.use((config) => {
+            const token = getToken();
+            if (token) {
+                config.headers.Authorization = `Bearer ${token}`;
+            }
+            return config;
+        });
+    }
+    return axiosInstance;
+}
+/**
+ * Create HTTP/HTTPS agent for raw requests with custom timeout
+ * @param protocol - 'http:' or 'https:'
+ * @param timeout - Request timeout in milliseconds
+ * @param config - Timeout configuration
+ */
+export function createAgentForProtocol(protocol, timeout, config = DEFAULT_TIMEOUT_CONFIG) {
+    const agentConfig = {
+        keepAlive: true,
+        keepAliveMsecs: config.keepAliveInterval,
+        timeout,
+        maxSockets: config.maxSockets,
+        maxFreeSockets: config.maxFreeSockets,
+    };
+    return protocol === 'https:'
+        ? new https.Agent(agentConfig)
+        : new http.Agent(agentConfig);
+}
+//# sourceMappingURL=http-factory.js.map

package/dist/internal/http-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-factory.js","sourceRoot":"","sources":["../../src/internal/http-factory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsB3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAS,6CAA6C;IAChF,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAM,mCAAmC;IACtE,eAAe,EAAE,EAAE,GAAG,IAAI,EAAS,8BAA8B;IACjE,cAAc,EAAE,EAAE,GAAG,IAAI,EAAU,mCAAmC;IACtE,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAO,uCAAuC;IAC1E,UAAU,EAAE,EAAE,EAAqB,qCAAqC;IACxE,cAAc,EAAE,EAAE,EAAiB,6BAA6B;CACjE,CAAC;AAkBF;;GAEG;AACH,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC;QACpB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,MAAM,CAAC,iBAAiB;QACxC,OAAO,EAAE,MAAM,CAAC,UAAU;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAyB;IACjD,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC;QACrB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,MAAM,CAAC,iBAAiB;QACxC,OAAO,EAAE,MAAM,CAAC,UAAU;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC;AASD;;GAEG;AACH,MAAM,oBAAoB,GAA0B;IAClD,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,KAAK;IACpB,sCAAsC;IACtC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;CACnD,CAAC;AAEF;;GAEG;AACH,SAAS,2BAA2B,CAAC,UAAkB,EAAE,SAAiB,EAAE,QAAgB;IAC1F,MAAM,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,QAA8D;IAC7F,2CAA2C;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAuD,CAAC;IAC9E,IAAI,IAAI,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtC,CAAC;IAED,2BAA2B;IAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACpB,OAAO,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,aAA4B,EAAE,SAAsB,EAAE;IACjF,MAAM,WAAW,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;IAQ3D,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CACrC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EACtB,KAAK,EAAE,KAAc,EAAE,EAAE;QACvB,uCAAuC;QACvC,MAAM,UAAU,GAAG,KAAyH,CAAC;QAC7I,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,aAAa,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,aAAa,CAAC,YAAY,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,YAAY,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YAClG,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,aAAa,CAAC,YAAY,EAAE,CAAC;QAE7B,IAAI,UAAkB,CAAC;QACvB,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE9F,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC9B,WAAW,CAAC,MAAM,CAAC,GAAG,CACpB,uBAAuB,aAAa,CAAC,YAAY,IAAI,WAAW,CAAC,UAAU,QAAQ,MAAM,cAAc,UAAU,uBAAuB,CACzI,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,2BAA2B,CAAC,aAAa,CAAC,YAAY,GAAG,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtH,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC9B,WAAW,CAAC,MAAM,CAAC,GAAG,CACpB,uBAAuB,aAAa,CAAC,YAAY,IAAI,WAAW,CAAC,UAAU,QAAQ,MAAM,cAAc,UAAU,0BAA0B,CAC5I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,aAAa,CAAC,OAAO,CAAC,aAA4D,CAAC,CAAC;IAC7F,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,aAAa,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAExE,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,aAAa,CAAC,UAAU;QACjC,SAAS,EAAE,eAAe,CAAC,aAAa,CAAC;QACzC,UAAU,EAAE,gBAAgB,CAAC,aAAa,CAAC;QAC3C,OAAO,EAAE;YACP,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;YAC/C,eAAe,EAAE,WAAW;SAC7B;KACF,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEhD,wBAAwB;IACxB,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAElD,gDAAgD;IAChD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACnD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,OAAe,EACf,SAA4B,sBAAsB;IAElD,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,MAAM,CAAC,iBAAiB;QACxC,OAAO;QACP,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IAEF,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC"}

package/dist/internal/index.d.ts

@@ -0,0 +1,5 @@
+/** Internal module exports. */
+export { createHttpClient, createAgentForProtocol, DEFAULT_TIMEOUT_CONFIG, type HttpClientOptions, type HttpTimeoutConfig, type RetryLogger, } from './http-factory.js';
+export { RetryExecutor, createRetryExecutor, type RetryConfig, type RawHttpOptions, type RawHttpResponse, } from './retry-executor.js';
+export { DecryptedCapsaCache, createCapsaCache, type CachedCapsa, type CachedFileMetadata, type CapsaCacheConfig, } from './capsa-cache.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/internal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAE/B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/internal/index.js

@@ -0,0 +1,5 @@
+/** Internal module exports. */
+export { createHttpClient, createAgentForProtocol, DEFAULT_TIMEOUT_CONFIG, } from './http-factory.js';
+export { RetryExecutor, createRetryExecutor, } from './retry-executor.js';
+export { DecryptedCapsaCache, createCapsaCache, } from './capsa-cache.js';
+//# sourceMappingURL=index.js.map

package/dist/internal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAE/B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GAIvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,mBAAmB,GAIpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GAIjB,MAAM,kBAAkB,CAAC"}

package/dist/internal/retry-executor.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Unified retry executor - eliminates retry logic duplication
+ * @file capsara.sdk/typescript/src/internal/retry-executor.ts
+ *
+ * This module provides a unified retry mechanism that can be used for:
+ * - Axios HTTP requests (via interceptor in http-factory)
+ * - Raw HTTP/HTTPS requests (for multipart uploads)
+ * - Generic async operations
+ */
+import * as http from 'http';
+import { type HttpTimeoutConfig } from './http-factory.js';
+/**
+ * Logger interface for retry operations
+ */
+export interface RetryLogger {
+    log: (message: string) => void;
+}
+/**
+ * Retry configuration
+ */
+export interface RetryConfig {
+    maxRetries?: number;
+    baseDelay?: number;
+    maxDelay?: number;
+    enableLogging?: boolean;
+    logger?: RetryLogger;
+}
+/**
+ * Options for raw HTTP requests
+ */
+export interface RawHttpOptions {
+    url: string;
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+    headers?: Record<string, string>;
+    body?: Buffer | string;
+    timeout?: number;
+    timeoutConfig?: HttpTimeoutConfig;
+}
+/**
+ * Response from raw HTTP request
+ */
+export interface RawHttpResponse {
+    statusCode: number;
+    headers: http.IncomingHttpHeaders;
+    body: Buffer;
+}
+/**
+ * Unified retry executor for both axios and raw HTTP requests
+ */
+export declare class RetryExecutor {
+    private config;
+    constructor(config?: RetryConfig);
+    /**
+     * Execute a generic async operation with retry
+     */
+    execute<T>(operation: () => Promise<T>, isRetryable?: (error: unknown) => boolean): Promise<T>;
+    /**
+     * Execute a raw HTTP request with retry (for multipart uploads)
+     *
+     * This replaces the duplicated retry logic in:
+     * - CapsaraClient#sendCapsasWithRetry (121 lines)
+     * - CapsaraClient#downloadFileWithRetry (54 lines)
+     */
+    executeRawHttp(options: RawHttpOptions): Promise<RawHttpResponse>;
+    /**
+     * Make a single raw HTTP request
+     */
+    private makeRawRequest;
+}
+/**
+ * Create a retry executor with default or custom configuration
+ */
+export declare function createRetryExecutor(config?: RetryConfig): RetryExecutor;
+//# sourceMappingURL=retry-executor.d.ts.map