@columnus/shared 0.1.47

package/dist/tenantSecretsCrypto.js

@@ -0,0 +1,145 @@
+// packages/@columnus/shared/src/tenantSecretsCrypto.ts
+var TENANT_SECRETS_KEK_ENV = "TENANT_SECRETS_KEK";
+var TENANT_SECRET_CRYPTO_VERSION = 1;
+var IV_BYTES = 12;
+var KEY_BYTES = 32;
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padLen = (4 - padded.length % 4) % 4;
+  const binary = atob(padded + "=".repeat(padLen));
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function hexDecode(hex) {
+  if (hex.length % 2 !== 0) {
+    throw new Error("TENANT_SECRETS_KEK hex must have even length");
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(byte)) {
+      throw new Error("TENANT_SECRETS_KEK hex contains non-hex characters");
+    }
+    out[i] = byte;
+  }
+  return out;
+}
+function parseTenantSecretsKek(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    throw new Error(`${TENANT_SECRETS_KEK_ENV} is empty`);
+  }
+  let bytes;
+  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {
+    bytes = hexDecode(trimmed);
+  } else {
+    try {
+      bytes = base64UrlDecode(trimmed);
+    } catch {
+      throw new Error(
+        `${TENANT_SECRETS_KEK_ENV} must be 32-byte key as base64/base64url or 64-char hex`
+      );
+    }
+  }
+  if (bytes.byteLength !== KEY_BYTES) {
+    throw new Error(
+      `${TENANT_SECRETS_KEK_ENV} must decode to exactly ${KEY_BYTES} bytes (got ${bytes.byteLength})`
+    );
+  }
+  return bytes;
+}
+function readTenantSecretsKekFromEnv(env) {
+  const raw = env[TENANT_SECRETS_KEK_ENV];
+  if (raw === void 0 || raw.trim() === "") {
+    throw new Error(`${TENANT_SECRETS_KEK_ENV} is not set`);
+  }
+  return parseTenantSecretsKek(raw);
+}
+function toArrayBufferView(bytes) {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy;
+}
+async function importAesKey(kek) {
+  if (kek.byteLength !== KEY_BYTES) {
+    throw new Error(`AES-256 KEK must be ${KEY_BYTES} bytes`);
+  }
+  return crypto.subtle.importKey("raw", toArrayBufferView(kek), { name: "AES-GCM" }, false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function encryptTenantSecret(plaintext, kek) {
+  const trimmed = plaintext.trim();
+  if (!trimmed) {
+    throw new Error("Refusing to encrypt empty secret");
+  }
+  const key = await importAesKey(kek);
+  const iv = new Uint8Array(IV_BYTES);
+  crypto.getRandomValues(iv);
+  const encrypted = new Uint8Array(
+    await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv: toArrayBufferView(iv) },
+      key,
+      new TextEncoder().encode(trimmed)
+    )
+  );
+  const packed = new Uint8Array(1 + IV_BYTES + encrypted.byteLength);
+  packed[0] = TENANT_SECRET_CRYPTO_VERSION;
+  packed.set(iv, 1);
+  packed.set(encrypted, 1 + IV_BYTES);
+  return {
+    ciphertext: base64UrlEncode(packed),
+    keyVersion: TENANT_SECRET_CRYPTO_VERSION
+  };
+}
+async function decryptTenantSecret(ciphertext, kek) {
+  const trimmed = ciphertext.trim();
+  if (!trimmed) {
+    throw new Error("Ciphertext is empty");
+  }
+  let packed;
+  try {
+    packed = base64UrlDecode(trimmed);
+  } catch {
+    throw new Error("Ciphertext is not valid base64url");
+  }
+  if (packed.byteLength < 1 + IV_BYTES + 16) {
+    throw new Error("Ciphertext is too short");
+  }
+  const version = packed[0];
+  if (version !== TENANT_SECRET_CRYPTO_VERSION) {
+    throw new Error(`Unsupported tenant secret crypto version: ${version}`);
+  }
+  const iv = packed.subarray(1, 1 + IV_BYTES);
+  const data = packed.subarray(1 + IV_BYTES);
+  const key = await importAesKey(kek);
+  let decrypted;
+  try {
+    decrypted = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: toArrayBufferView(iv) },
+      key,
+      toArrayBufferView(data)
+    );
+  } catch {
+    throw new Error("Failed to decrypt tenant secret (wrong key or corrupt ciphertext)");
+  }
+  return new TextDecoder().decode(decrypted);
+}
+function generateTenantSecretsKekBase64() {
+  const bytes = new Uint8Array(KEY_BYTES);
+  crypto.getRandomValues(bytes);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+export { TENANT_SECRETS_KEK_ENV, TENANT_SECRET_CRYPTO_VERSION, decryptTenantSecret, encryptTenantSecret, generateTenantSecretsKekBase64, parseTenantSecretsKek, readTenantSecretsKekFromEnv };
+//# sourceMappingURL=tenantSecretsCrypto.js.map
+//# sourceMappingURL=tenantSecretsCrypto.js.map

package/dist/tenantSecretsCrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tenantSecretsCrypto.ts"],"names":[],"mappings":";AASO,IAAM,sBAAA,GAAyB;AAG/B,IAAM,4BAAA,GAA+B;AAE5C,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,SAAA,GAAY,EAAA;AAUlB,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAChF;AAEA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACzD,EAAA,MAAM,MAAA,GAAA,CAAU,CAAA,GAAK,MAAA,CAAO,MAAA,GAAS,CAAA,IAAM,CAAA;AAC3C,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA,GAAS,GAAA,CAAI,MAAA,CAAO,MAAM,CAAC,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,UAAU,GAAA,EAAyB;AAC1C,EAAA,IAAI,GAAA,CAAI,MAAA,GAAS,CAAA,KAAM,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,EAChE;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAC5D,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACtE;AACA,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,sBAAsB,GAAA,EAAyB;AAC7D,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AACzB,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAA,SAAA,CAAW,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,mBAAA,CAAoB,IAAA,CAAK,OAAO,CAAA,EAAG;AACrC,IAAA,KAAA,GAAQ,UAAU,OAAO,CAAA;AAAA,EAC3B,CAAA,MAAO;AACL,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,gBAAgB,OAAO,CAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,GAAG,sBAAsB,CAAA,uDAAA;AAAA,OAC3B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,eAAe,SAAA,EAAW;AAClC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,GAAG,sBAAsB,CAAA,wBAAA,EAA2B,SAAS,CAAA,YAAA,EAAe,MAAM,UAAU,CAAA,CAAA;AAAA,KAC9F;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAA4B,GAAA,EAAiC;AAC3E,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAsB,CAAA;AACtC,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAC1C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAA,WAAA,CAAa,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,sBAAsB,GAAG,CAAA;AAClC;AAGA,SAAS,kBAAkB,KAAA,EAA4C;AACrE,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,KAAA,CAAM,UAAU,CAAA;AAC5C,EAAA,IAAA,CAAK,IAAI,KAAK,CAAA;AACd,EAAA,OAAO,IAAA;AACT;AAEA,eAAe,aAAa,GAAA,EAAiB;AAC3C,EAAA,IAAI,GAAA,CAAI,eAAe,SAAA,EAAW;AAChC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAS,CAAA,MAAA,CAAQ,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,iBAAA,CAAkB,GAAG,CAAA,EAAG,EAAE,IAAA,EAAM,SAAA,EAAU,EAAG,KAAA,EAAO;AAAA,IACxF,SAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,eAAsB,mBAAA,CACpB,WACA,GAAA,EACgC;AAChC,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,GAAG,CAAA;AAClC,EAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,QAAQ,CAAA;AAClC,EAAA,MAAA,CAAO,gBAAgB,EAAE,CAAA;AAEzB,EAAA,MAAM,YAAY,IAAI,UAAA;AAAA,IACpB,MAAM,OAAO,MAAA,CAAO,OAAA;AAAA,MAClB,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,iBAAA,CAAkB,EAAE,CAAA,EAAE;AAAA,MAC7C,GAAA;AAAA,MACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO;AAAA;AAClC,GACF;AAEA,EAAA,MAAM,SAAS,IAAI,UAAA,CAAW,CAAA,GAAI,QAAA,GAAW,UAAU,UAAU,CAAA;AACjE,EAAA,MAAA,CAAO,CAAC,CAAA,GAAI,4BAAA;AACZ,EAAA,MAAA,CAAO,GAAA,CAAI,IAAI,CAAC,CAAA;AAChB,EAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,CAAA,GAAI,QAAQ,CAAA;AAElC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,gBAAgB,MAAM,CAAA;AAAA,IAClC,UAAA,EAAY;AAAA,GACd;AACF;AAGA,eAAsB,mBAAA,CAAoB,YAAoB,GAAA,EAAkC;AAC9F,EAAA,MAAM,OAAA,GAAU,WAAW,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,MAAM,qBAAqB,CAAA;AAAA,EACvC;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,gBAAgB,OAAO,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACrD;AAEA,EAAA,IAAI,MAAA,CAAO,UAAA,GAAa,CAAA,GAAI,QAAA,GAAW,EAAA,EAAI;AACzC,IAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,CAAC,CAAA;AACxB,EAAA,IAAI,YAAY,4BAAA,EAA8B;AAC5C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0CAAA,EAA6C,OAAO,CAAA,CAAE,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,CAAA,EAAG,IAAI,QAAQ,CAAA;AAC1C,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,CAAA,GAAI,QAAQ,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,GAAG,CAAA;AAElC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,OAAA;AAAA,MAC9B,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,iBAAA,CAAkB,EAAE,CAAA,EAAE;AAAA,MAC7C,GAAA;AAAA,MACA,kBAAkB,IAAI;AAAA,KACxB;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,mEAAmE,CAAA;AAAA,EACrF;AAEA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAA;AAC3C;AAGO,SAAS,8BAAA,GAAyC;AACvD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,SAAS,CAAA;AACtC,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB","file":"tenantSecretsCrypto.js","sourcesContent":["/**\n * App-level encryption for management-plane tenant secrets (deploy keys).\n * AES-256-GCM, random 12-byte IV, version byte prefix in the ciphertext blob.\n *\n * KEK: set `TENANT_SECRETS_KEK` on the management Convex deployment to 32 raw\n * bytes encoded as standard/base64url base64 or 64-char hex\n * (`openssl rand -base64 32`).\n */\n\nexport const TENANT_SECRETS_KEK_ENV = \"TENANT_SECRETS_KEK\";\n\n/** Ciphertext format / algorithm version (stored as first byte + `keyVersion`). */\nexport const TENANT_SECRET_CRYPTO_VERSION = 1;\n\nconst IV_BYTES = 12;\nconst KEY_BYTES = 32;\n\nexport type EncryptedTenantSecret = {\n  /** base64url(version || iv || ciphertext+tag) */\n  ciphertext: string;\n  keyVersion: number;\n};\n\ntype ProcessEnvLike = Record<string, string | undefined>;\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padLen = (4 - (padded.length % 4)) % 4;\n  const binary = atob(padded + \"=\".repeat(padLen));\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n  return out;\n}\n\nfunction hexDecode(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) {\n    throw new Error(\"TENANT_SECRETS_KEK hex must have even length\");\n  }\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) {\n    const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n    if (Number.isNaN(byte)) {\n      throw new Error(\"TENANT_SECRETS_KEK hex contains non-hex characters\");\n    }\n    out[i] = byte;\n  }\n  return out;\n}\n\n/** Parse a 32-byte KEK from base64, base64url, or hex. */\nexport function parseTenantSecretsKek(raw: string): Uint8Array {\n  const trimmed = raw.trim();\n  if (!trimmed) {\n    throw new Error(`${TENANT_SECRETS_KEK_ENV} is empty`);\n  }\n\n  let bytes: Uint8Array;\n  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {\n    bytes = hexDecode(trimmed);\n  } else {\n    try {\n      bytes = base64UrlDecode(trimmed);\n    } catch {\n      throw new Error(\n        `${TENANT_SECRETS_KEK_ENV} must be 32-byte key as base64/base64url or 64-char hex`,\n      );\n    }\n  }\n\n  if (bytes.byteLength !== KEY_BYTES) {\n    throw new Error(\n      `${TENANT_SECRETS_KEK_ENV} must decode to exactly ${KEY_BYTES} bytes (got ${bytes.byteLength})`,\n    );\n  }\n  return bytes;\n}\n\nexport function readTenantSecretsKekFromEnv(env: ProcessEnvLike): Uint8Array {\n  const raw = env[TENANT_SECRETS_KEK_ENV];\n  if (raw === undefined || raw.trim() === \"\") {\n    throw new Error(`${TENANT_SECRETS_KEK_ENV} is not set`);\n  }\n  return parseTenantSecretsKek(raw);\n}\n\n/** Copy into a standalone buffer so Web Crypto accepts the view under strict DOM typings. */\nfunction toArrayBufferView(bytes: Uint8Array): Uint8Array<ArrayBuffer> {\n  const copy = new Uint8Array(bytes.byteLength);\n  copy.set(bytes);\n  return copy;\n}\n\nasync function importAesKey(kek: Uint8Array) {\n  if (kek.byteLength !== KEY_BYTES) {\n    throw new Error(`AES-256 KEK must be ${KEY_BYTES} bytes`);\n  }\n  return crypto.subtle.importKey(\"raw\", toArrayBufferView(kek), { name: \"AES-GCM\" }, false, [\n    \"encrypt\",\n    \"decrypt\",\n  ]);\n}\n\n/**\n * Encrypt a tenant secret (e.g. Convex deploy key).\n * Returns opaque ciphertext for `tenant_secrets.convexDeployKeyCiphertext`\n * and `keyVersion` for the schema column.\n */\nexport async function encryptTenantSecret(\n  plaintext: string,\n  kek: Uint8Array,\n): Promise<EncryptedTenantSecret> {\n  const trimmed = plaintext.trim();\n  if (!trimmed) {\n    throw new Error(\"Refusing to encrypt empty secret\");\n  }\n\n  const key = await importAesKey(kek);\n  const iv = new Uint8Array(IV_BYTES);\n  crypto.getRandomValues(iv);\n\n  const encrypted = new Uint8Array(\n    await crypto.subtle.encrypt(\n      { name: \"AES-GCM\", iv: toArrayBufferView(iv) },\n      key,\n      new TextEncoder().encode(trimmed),\n    ),\n  );\n\n  const packed = new Uint8Array(1 + IV_BYTES + encrypted.byteLength);\n  packed[0] = TENANT_SECRET_CRYPTO_VERSION;\n  packed.set(iv, 1);\n  packed.set(encrypted, 1 + IV_BYTES);\n\n  return {\n    ciphertext: base64UrlEncode(packed),\n    keyVersion: TENANT_SECRET_CRYPTO_VERSION,\n  };\n}\n\n/** Decrypt a blob produced by {@link encryptTenantSecret}. */\nexport async function decryptTenantSecret(ciphertext: string, kek: Uint8Array): Promise<string> {\n  const trimmed = ciphertext.trim();\n  if (!trimmed) {\n    throw new Error(\"Ciphertext is empty\");\n  }\n\n  let packed: Uint8Array;\n  try {\n    packed = base64UrlDecode(trimmed);\n  } catch {\n    throw new Error(\"Ciphertext is not valid base64url\");\n  }\n\n  if (packed.byteLength < 1 + IV_BYTES + 16) {\n    throw new Error(\"Ciphertext is too short\");\n  }\n\n  const version = packed[0];\n  if (version !== TENANT_SECRET_CRYPTO_VERSION) {\n    throw new Error(`Unsupported tenant secret crypto version: ${version}`);\n  }\n\n  const iv = packed.subarray(1, 1 + IV_BYTES);\n  const data = packed.subarray(1 + IV_BYTES);\n  const key = await importAesKey(kek);\n\n  let decrypted: ArrayBuffer;\n  try {\n    decrypted = await crypto.subtle.decrypt(\n      { name: \"AES-GCM\", iv: toArrayBufferView(iv) },\n      key,\n      toArrayBufferView(data),\n    );\n  } catch {\n    throw new Error(\"Failed to decrypt tenant secret (wrong key or corrupt ciphertext)\");\n  }\n\n  return new TextDecoder().decode(decrypted);\n}\n\n/** Generate a new KEK suitable for `TENANT_SECRETS_KEK` (base64). */\nexport function generateTenantSecretsKekBase64(): string {\n  const bytes = new Uint8Array(KEY_BYTES);\n  crypto.getRandomValues(bytes);\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n"]}

package/dist/useDebouncedCommit.d.ts

@@ -0,0 +1,11 @@
+type Options<T> = {
+    delay?: number;
+    equals?: (a: T, b: T) => boolean;
+};
+/** Local draft with debounced commit; `resetDraft` cancels pending timers and commits immediately. */
+export declare function useDebouncedCommit<T>(applied: T, onCommit: (value: T) => void, options?: Options<T>): {
+    draft: T;
+    setDraft: import("react").Dispatch<import("react").SetStateAction<T>>;
+    resetDraft: (value: T) => void;
+};
+export {};

package/dist/useDebouncedCommit.js

@@ -0,0 +1,34 @@
+import { useState, useRef, useEffect, useCallback } from 'react';
+
+// packages/@columnus/shared/src/useDebouncedCommit.ts
+function useDebouncedCommit(applied, onCommit, options) {
+  const delay = options?.delay ?? 300;
+  const equals = options?.equals ?? ((a, b) => a === b);
+  const [draft, setDraft] = useState(applied);
+  const generationRef = useRef(0);
+  useEffect(() => {
+    setDraft(applied);
+  }, [applied]);
+  useEffect(() => {
+    if (equals(draft, applied)) return;
+    const generation = generationRef.current;
+    const timer = setTimeout(() => {
+      if (generation !== generationRef.current) return;
+      onCommit(draft);
+    }, delay);
+    return () => clearTimeout(timer);
+  }, [draft, applied, onCommit, delay, equals]);
+  const resetDraft = useCallback(
+    (value) => {
+      generationRef.current += 1;
+      setDraft(value);
+      if (!equals(value, applied)) onCommit(value);
+    },
+    [applied, onCommit, equals]
+  );
+  return { draft, setDraft, resetDraft };
+}
+
+export { useDebouncedCommit };
+//# sourceMappingURL=useDebouncedCommit.js.map
+//# sourceMappingURL=useDebouncedCommit.js.map

package/dist/useDebouncedCommit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/useDebouncedCommit.ts"],"names":[],"mappings":";;;AAQO,SAAS,kBAAA,CACd,OAAA,EACA,QAAA,EACA,OAAA,EACA;AACA,EAAA,MAAM,KAAA,GAAQ,SAAS,KAAA,IAAS,GAAA;AAChC,EAAA,MAAM,SAAS,OAAA,EAAS,MAAA,KAAW,CAAC,CAAA,EAAG,MAAM,CAAA,KAAM,CAAA,CAAA;AACnD,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAS,OAAO,CAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,OAAO,CAAC,CAAA;AAE9B,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,QAAA,CAAS,OAAO,CAAA;AAAA,EAClB,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAEZ,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,OAAO,CAAA,EAAG;AAC5B,IAAA,MAAM,aAAa,aAAA,CAAc,OAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,IAAI,UAAA,KAAe,cAAc,OAAA,EAAS;AAC1C,MAAA,QAAA,CAAS,KAAK,CAAA;AAAA,IAChB,GAAG,KAAK,CAAA;AACR,IAAA,OAAO,MAAM,aAAa,KAAK,CAAA;AAAA,EACjC,GAAG,CAAC,KAAA,EAAO,SAAS,QAAA,EAAU,KAAA,EAAO,MAAM,CAAC,CAAA;AAE5C,EAAA,MAAM,UAAA,GAAa,WAAA;AAAA,IACjB,CAAC,KAAA,KAAa;AACZ,MAAA,aAAA,CAAc,OAAA,IAAW,CAAA;AACzB,MAAA,QAAA,CAAS,KAAK,CAAA;AACd,MAAA,IAAI,CAAC,MAAA,CAAO,KAAA,EAAO,OAAO,CAAA,WAAY,KAAK,CAAA;AAAA,IAC7C,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,MAAM;AAAA,GAC5B;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,UAAA,EAAW;AACvC","file":"useDebouncedCommit.js","sourcesContent":["import { useCallback, useEffect, useRef, useState } from \"react\";\n\ntype Options<T> = {\n  delay?: number;\n  equals?: (a: T, b: T) => boolean;\n};\n\n/** Local draft with debounced commit; `resetDraft` cancels pending timers and commits immediately. */\nexport function useDebouncedCommit<T>(\n  applied: T,\n  onCommit: (value: T) => void,\n  options?: Options<T>,\n) {\n  const delay = options?.delay ?? 300;\n  const equals = options?.equals ?? ((a, b) => a === b);\n  const [draft, setDraft] = useState(applied);\n  const generationRef = useRef(0);\n\n  useEffect(() => {\n    setDraft(applied);\n  }, [applied]);\n\n  useEffect(() => {\n    if (equals(draft, applied)) return;\n    const generation = generationRef.current;\n    const timer = setTimeout(() => {\n      if (generation !== generationRef.current) return;\n      onCommit(draft);\n    }, delay);\n    return () => clearTimeout(timer);\n  }, [draft, applied, onCommit, delay, equals]);\n\n  const resetDraft = useCallback(\n    (value: T) => {\n      generationRef.current += 1;\n      setDraft(value);\n      if (!equals(value, applied)) onCommit(value);\n    },\n    [applied, onCommit, equals],\n  );\n\n  return { draft, setDraft, resetDraft };\n}\n"]}

package/dist/useDebouncedValue.d.ts

@@ -0,0 +1 @@
+export declare function useDebouncedValue<T>(value: T, ms: number): T;

package/dist/useDebouncedValue.js

@@ -0,0 +1,15 @@
+import { useState, useEffect } from 'react';
+
+// packages/@columnus/shared/src/useDebouncedValue.ts
+function useDebouncedValue(value, ms) {
+  const [debounced, setDebounced] = useState(value);
+  useEffect(() => {
+    const timer = setTimeout(() => setDebounced(value), ms);
+    return () => clearTimeout(timer);
+  }, [value, ms]);
+  return debounced;
+}
+
+export { useDebouncedValue };
+//# sourceMappingURL=useDebouncedValue.js.map
+//# sourceMappingURL=useDebouncedValue.js.map

package/dist/useDebouncedValue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/useDebouncedValue.ts"],"names":[],"mappings":";;;AAEO,SAAS,iBAAA,CAAqB,OAAU,EAAA,EAAe;AAC5D,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAI,SAAS,KAAK,CAAA;AAChD,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,YAAA,CAAa,KAAK,GAAG,EAAE,CAAA;AACtD,IAAA,OAAO,MAAM,aAAa,KAAK,CAAA;AAAA,EACjC,CAAA,EAAG,CAAC,KAAA,EAAO,EAAE,CAAC,CAAA;AACd,EAAA,OAAO,SAAA;AACT","file":"useDebouncedValue.js","sourcesContent":["import { useEffect, useState } from \"react\";\n\nexport function useDebouncedValue<T>(value: T, ms: number): T {\n  const [debounced, setDebounced] = useState(value);\n  useEffect(() => {\n    const timer = setTimeout(() => setDebounced(value), ms);\n    return () => clearTimeout(timer);\n  }, [value, ms]);\n  return debounced;\n}\n"]}

package/dist/useModifierHeld.d.ts

@@ -0,0 +1,2 @@
+/** True while ⌘ (Mac) or Ctrl (Windows/Linux) is held. */
+export declare function useModifierHeld(): boolean;

package/dist/useModifierHeld.js

@@ -0,0 +1,28 @@
+import { useState, useEffect } from 'react';
+
+// packages/@columnus/shared/src/useModifierHeld.ts
+function useModifierHeld() {
+  const [held, setHeld] = useState(false);
+  useEffect(() => {
+    const onKeyDown = (e) => {
+      if (e.metaKey || e.ctrlKey) setHeld(true);
+    };
+    const onKeyUp = (e) => {
+      if (!e.metaKey && !e.ctrlKey) setHeld(false);
+    };
+    const onBlur = () => setHeld(false);
+    window.addEventListener("keydown", onKeyDown);
+    window.addEventListener("keyup", onKeyUp);
+    window.addEventListener("blur", onBlur);
+    return () => {
+      window.removeEventListener("keydown", onKeyDown);
+      window.removeEventListener("keyup", onKeyUp);
+      window.removeEventListener("blur", onBlur);
+    };
+  }, []);
+  return held;
+}
+
+export { useModifierHeld };
+//# sourceMappingURL=useModifierHeld.js.map
+//# sourceMappingURL=useModifierHeld.js.map

package/dist/useModifierHeld.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/useModifierHeld.ts"],"names":[],"mappings":";;;AAGO,SAAS,eAAA,GAA2B;AACzC,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,SAAS,KAAK,CAAA;AAEtC,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,MAAM,SAAA,GAAY,CAAC,CAAA,KAAqB;AACtC,MAAA,IAAI,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,OAAA,UAAiB,IAAI,CAAA;AAAA,IAC1C,CAAA;AACA,IAAA,MAAM,OAAA,GAAU,CAAC,CAAA,KAAqB;AACpC,MAAA,IAAI,CAAC,CAAA,CAAE,OAAA,IAAW,CAAC,CAAA,CAAE,OAAA,UAAiB,KAAK,CAAA;AAAA,IAC7C,CAAA;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,KAAK,CAAA;AAElC,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,MAAA,CAAO,gBAAA,CAAiB,SAAS,OAAO,CAAA;AACxC,IAAA,MAAA,CAAO,gBAAA,CAAiB,QAAQ,MAAM,CAAA;AACtC,IAAA,OAAO,MAAM;AACX,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,mBAAA,CAAoB,QAAQ,MAAM,CAAA;AAAA,IAC3C,CAAA;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,OAAO,IAAA;AACT","file":"useModifierHeld.js","sourcesContent":["import { useEffect, useState } from \"react\";\n\n/** True while ⌘ (Mac) or Ctrl (Windows/Linux) is held. */\nexport function useModifierHeld(): boolean {\n  const [held, setHeld] = useState(false);\n\n  useEffect(() => {\n    const onKeyDown = (e: KeyboardEvent) => {\n      if (e.metaKey || e.ctrlKey) setHeld(true);\n    };\n    const onKeyUp = (e: KeyboardEvent) => {\n      if (!e.metaKey && !e.ctrlKey) setHeld(false);\n    };\n    const onBlur = () => setHeld(false);\n\n    window.addEventListener(\"keydown\", onKeyDown);\n    window.addEventListener(\"keyup\", onKeyUp);\n    window.addEventListener(\"blur\", onBlur);\n    return () => {\n      window.removeEventListener(\"keydown\", onKeyDown);\n      window.removeEventListener(\"keyup\", onKeyUp);\n      window.removeEventListener(\"blur\", onBlur);\n    };\n  }, []);\n\n  return held;\n}\n"]}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@columnus/shared",
+  "version": "0.1.47",
+  "private": false,
+  "type": "module",
+  "description": "Columnus shared package (CMS install family)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/movement-overdrive/convex-studio.git",
+    "directory": "packages/@columnus/shared"
+  },
+  "homepage": "https://github.com/movement-overdrive/convex-studio/tree/main/packages/@columnus/shared",
+  "bugs": {
+    "url": "https://github.com/movement-overdrive/convex-studio/issues"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js"
+  },
+  "dependencies": {
+    "papaparse": "^5.5.4",
+    "zod": "^3.25.76"
+  },
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "peerDependenciesMeta": {},
+  "publishConfig": {
+    "access": "public"
+  }
+}