@e-sig/supabase 0.2.0 → 0.3.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Opendelphi contributors
+Copyright (c) 2026 VMVTech, Ltd.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { SupabaseCertStore, type SupabaseCertStoreOptions, } from "./cert-store.js";
+export { SupabasePqKeyStore, type SupabasePqKeyStoreOptions, } from "./pq-key-store.js";
 export { SupabaseAuditLogStore, type SupabaseAuditLogStoreOptions, } from "./audit-store.js";
 export { SupabasePdfStorageStore, type SupabasePdfStorageStoreOptions, } from "./storage.js";
 export { verifyAuditChain, type VerifyAuditChainOptions, type VerifyAuditChainResult, type AuditChainFailure, } from "./audit-chain.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,12 +1,13 @@
 // @e-sig/supabase
 //
 // Supabase reference implementations of the @e-sig/core persistence
-// interfaces (CertStore, AuditLogStore, PdfStorageStore), plus the
+// interfaces (CertStore, PqKeyStore, AuditLogStore, PdfStorageStore), plus the
 // verifyAuditChain() tamper-evidence checker for the audit hash chain. Pair
 // with the bundled migrations (migrations/0001_esig_self_contained.sql +
-// 0002_esig_audit_hashchain.sql). Table/bucket/tenant-column names are
-// configurable so you can map onto your existing schema.
+// 0002_esig_audit_hashchain.sql + 0003_esig_pq_keys.sql). Table/bucket/
+// tenant-column names are configurable so you can map onto your existing schema.
 export { SupabaseCertStore, } from "./cert-store.js";
+export { SupabasePqKeyStore, } from "./pq-key-store.js";
 export { SupabaseAuditLogStore, } from "./audit-store.js";
 export { SupabasePdfStorageStore, } from "./storage.js";
 export { verifyAuditChain, } from "./audit-chain.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,4EAA4E;AAC5E,yEAAyE;AACzE,uEAAuE;AACvE,yDAAyD;AAEzD,OAAO,EACL,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,GAIjB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,oEAAoE;AACpE,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,iFAAiF;AAEjF,OAAO,EACL,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,GAIjB,MAAM,kBAAkB,CAAC"}

package/dist/pq-key-store.d.ts

@@ -0,0 +1,23 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { PqKeyStore, StoredPqKeys, PqPublicMaterial } from "@e-sig/core";
+export interface SupabasePqKeyStoreOptions {
+    /** Table name. Default `org_pq_keys`. */
+    table?: string;
+    /** Tenant key column. Default `tenant_id`. */
+    tenantColumn?: string;
+}
+export declare class SupabasePqKeyStore implements PqKeyStore {
+    private sb;
+    private table;
+    private tenantColumn;
+    constructor(sb: SupabaseClient, opts?: SupabasePqKeyStoreOptions);
+    findActive(tenantId: string): Promise<StoredPqKeys | null>;
+    insert(input: {
+        tenantId: string;
+        keyBundleEncrypted: Uint8Array;
+        public: PqPublicMaterial;
+        rotatedFromId?: string | null;
+    }): Promise<StoredPqKeys>;
+    deactivate(id: string): Promise<void>;
+}
+//# sourceMappingURL=pq-key-store.d.ts.map

package/dist/pq-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-key-store.d.ts","sourceRoot":"","sources":["../src/pq-key-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAgB9E,MAAM,WAAW,yBAAyB;IACxC,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA0BD,qBAAa,kBAAmB,YAAW,UAAU;IAGvC,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,YAAY,CAAS;gBACT,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE,yBAA8B;IAKtE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW1D,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,kBAAkB,EAAE,UAAU,CAAC;QAC/B,MAAM,EAAE,gBAAgB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBnB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5C"}

package/dist/pq-key-store.js

@@ -0,0 +1,82 @@
+// @e-sig/supabase — SupabasePqKeyStore
+//
+// PqKeyStore backed by a Postgres table (default `org_pq_keys`) via supabase-js.
+// Matches migrations/0003_esig_pq_keys.sql. Drive it with ensureActivePqKeys /
+// rotatePqKeys from @e-sig/core. Mirrors SupabaseCertStore, including the bytea
+// `\x<hex>` wire-encoding workaround for the encrypted bundle.
+/** Decode a Postgres bytea (`\x<hex>` from PostgREST, or already-bytes) to a Uint8Array. */
+function decodeBytea(raw) {
+    if (raw instanceof Uint8Array)
+        return raw;
+    if (typeof raw === "string" && raw.startsWith("\\x"))
+        return Buffer.from(raw.slice(2), "hex");
+    if (typeof raw === "string")
+        return Buffer.from(raw, "base64");
+    return new Uint8Array();
+}
+function toStoredPqKeys(r, tenantColumn) {
+    const tenantId = r[tenantColumn] ?? r.tenant_id ?? r.org_id ?? "";
+    return {
+        id: r.id,
+        tenantId,
+        keyBundleEncrypted: decodeBytea(r.key_bundle_encrypted),
+        ed25519Public: r.ed25519_public,
+        mldsa65Public: r.mldsa65_public,
+        mldsa65Fpr: r.mldsa65_fpr,
+        keyId: r.key_id,
+        active: r.active,
+        rotatedFromId: r.rotated_from,
+        createdAt: new Date(r.created_at),
+    };
+}
+export class SupabasePqKeyStore {
+    sb;
+    table;
+    tenantColumn;
+    constructor(sb, opts = {}) {
+        this.sb = sb;
+        this.table = opts.table ?? "org_pq_keys";
+        this.tenantColumn = opts.tenantColumn ?? "tenant_id";
+    }
+    async findActive(tenantId) {
+        const { data, error } = await this.sb
+            .from(this.table)
+            .select("*")
+            .eq(this.tenantColumn, tenantId)
+            .eq("active", true)
+            .maybeSingle();
+        if (error)
+            throw new Error(`SupabasePqKeyStore.findActive: ${error.message}`);
+        return data ? toStoredPqKeys(data, this.tenantColumn) : null;
+    }
+    async insert(input) {
+        // bytea wire encoding: supabase-js JSON-stringifies a Uint8Array, mangling
+        // the round-trip. Pre-encode as Postgres bytea-in hex form `\x<hex>`.
+        const bytes = Buffer.isBuffer(input.keyBundleEncrypted)
+            ? input.keyBundleEncrypted
+            : Buffer.from(input.keyBundleEncrypted);
+        const hexEncoded = "\\x" + bytes.toString("hex");
+        const { data, error } = await this.sb
+            .from(this.table)
+            .insert({
+            [this.tenantColumn]: input.tenantId,
+            key_bundle_encrypted: hexEncoded,
+            ed25519_public: input.public.ed25519,
+            mldsa65_public: input.public.mldsa65,
+            mldsa65_fpr: input.public.mldsa65Fpr,
+            key_id: input.public.keyId,
+            rotated_from: input.rotatedFromId ?? null,
+        })
+            .select()
+            .single();
+        if (error || !data)
+            throw new Error(`SupabasePqKeyStore.insert: ${error?.message}`);
+        return toStoredPqKeys(data, this.tenantColumn);
+    }
+    async deactivate(id) {
+        const { error } = await this.sb.from(this.table).update({ active: false }).eq("id", id);
+        if (error)
+            throw new Error(`SupabasePqKeyStore.deactivate: ${error.message}`);
+    }
+}
+//# sourceMappingURL=pq-key-store.js.map

package/dist/pq-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-key-store.js","sourceRoot":"","sources":["../src/pq-key-store.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,+DAA+D;AA0B/D,4FAA4F;AAC5F,SAAS,WAAW,CAAC,GAAwB;IAC3C,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,CAAW,EAAE,YAAoB;IACvD,MAAM,QAAQ,GAAI,CAAC,CAAC,YAA8B,CAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAChG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ;QACR,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACvD,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,KAAK,EAAE,CAAC,CAAC,MAAM;QACf,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IAGT;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAkC,EAAE;QAAxD,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;aAC/B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,oBAAoB,EAAE,UAAU;YAChC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YACpC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YACpC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YAC1B,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;SAC1C,CAAC;aACD,MAAM,EAAE;aACR,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,OAAO,cAAc,CAAC,IAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@e-sig/supabase",
-  "version": "0.2.0",
-  "description": "Supabase adapters (CertStore / AuditLogStore / PdfStorageStore) for @e-sig/core — self-contained PDF e-signature persistence on Supabase Postgres + Storage.",
+  "version": "0.3.1",
+  "description": "Supabase adapters (CertStore / AuditLogStore / PdfStorageStore) for @e-sig/core \u2014 self-contained PDF e-signature persistence on Supabase Postgres + Storage.",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,14 +48,14 @@
   "homepage": "https://github.com/vmvtech/esig-suite/tree/main/packages/esig-supabase#readme",
   "peerDependencies": {
     "@supabase/supabase-js": ">=2",
-    "@e-sig/core": "^0.4.0 || ^0.5.0"
+    "@e-sig/core": "^0.4.0 || ^0.5.0 || ^0.6.0 || ^0.7.0"
   },
   "devDependencies": {
     "@supabase/supabase-js": "^2.98.0",
     "@types/node": "^22.0.0",
-    "@e-sig/core": "^0.5.0",
+    "@e-sig/core": "^0.7.0",
     "typescript": "^5.4.0",
-    "vitest": "^2.1.9"
+    "vitest": "^4.1.10"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",