@fgv/ts-extras 5.1.0-5 → 5.1.0-50

package/lib/packlets/crypto-utils/keystore/model.d.ts

@@ -1,11 +1,30 @@
-import { EncryptionAlgorithm, ICryptoProvider, IKeyDerivationParams } from '../model';
+import { JsonValue } from '@fgv/ts-json-base';
+import { EncryptionAlgorithm, ICryptoProvider, IArgon2idParams, IKeyDerivationParams, IPbkdf2KeyDerivationParams, KeyPairAlgorithm } from '../model';
+import { IPrivateKeyStorage } from './privateKeyStorage';
+export { allKeyPairAlgorithms, KeyPairAlgorithm } from '../model';
 /**
  * Format version for key store files.
+ *
+ * - `'keystore-v1'`: the original format (no private-key escrow).
+ * - `'keystore-v2'`: adds the optional `escrowedPrivateKeyJwk` field on
+ *   asymmetric-keypair entries. A strict superset of v1 — the field is
+ *   optional, so a v2 reader opens a v1 vault with no special-casing, and a
+ *   v1 vault opened and re-saved is silently upgraded to v2.
+ * - `'keystore-v3'`: adds the `'opaque'` symmetric secret type and the optional
+ *   `metadata` / `updatedAt` fields on symmetric entries. A strict superset of
+ *   v1/v2 — the additions are optional (and `'opaque'` is simply a new enum
+ *   value), so a v3 reader opens a v1/v2 vault with no special-casing, and a
+ *   v1/v2 vault opened and re-saved is silently upgraded to v3.
  * @public
  */
-export type KeyStoreFormat = 'keystore-v1';
+export type KeyStoreFormat = 'keystore-v1' | 'keystore-v2' | 'keystore-v3';
 /**
- * Current format version constant.
+ * All recognized key store format versions (readable by the current library).
+ * @public
+ */
+export declare const allKeyStoreFormats: ReadonlyArray<KeyStoreFormat>;
+/**
+ * Current format version constant. New vaults are written as `'keystore-v3'`.
  * @public
  */
 export declare const KEYSTORE_FORMAT: KeyStoreFormat;
@@ -21,60 +40,187 @@ export declare const DEFAULT_KEYSTORE_ITERATIONS: number;
  */
 export declare const MIN_SALT_LENGTH: number;
 /**
- * Discriminator for secret types stored in the vault.
+ * Discriminator for symmetric secret types stored in the vault.
  * - `'encryption-key'`: A 32-byte AES-256 encryption key.
  * - `'api-key'`: An arbitrary-length API key string (UTF-8 encoded).
+ * - `'opaque'`: Arbitrary raw bytes with no encoding contract — stored and
+ *   returned verbatim (never UTF-8 decoded). Use for byte blobs that are
+ *   neither a fixed-size AES key nor a UTF-8 string (e.g. a serialized
+ *   credential bundle), so they are not mistyped as `'api-key'`.
+ * @public
+ */
+export type KeyStoreSymmetricSecretType = 'encryption-key' | 'api-key' | 'opaque';
+/**
+ * All valid symmetric secret types.
+ * @public
+ */
+export declare const allKeyStoreSymmetricSecretTypes: ReadonlyArray<KeyStoreSymmetricSecretType>;
+/**
+ * Discriminator for asymmetric secret types stored in the vault.
+ * - `'asymmetric-keypair'`: A public/private key pair. The public key is held in
+ *   the vault as a JWK; the private key lives in the supplied
+ *   {@link CryptoUtils.KeyStore.IPrivateKeyStorage} provider.
+ * @public
+ */
+export type KeyStoreAsymmetricSecretType = 'asymmetric-keypair';
+/**
+ * All valid asymmetric secret types.
+ * @public
+ */
+export declare const allKeyStoreAsymmetricSecretTypes: ReadonlyArray<KeyStoreAsymmetricSecretType>;
+/**
+ * Discriminator for any secret type stored in the vault.
  * @public
  */
-export type KeyStoreSecretType = 'encryption-key' | 'api-key';
+export type KeyStoreSecretType = KeyStoreSymmetricSecretType | KeyStoreAsymmetricSecretType;
 /**
  * All valid key store secret types.
  * @public
  */
 export declare const allKeyStoreSecretTypes: ReadonlyArray<KeyStoreSecretType>;
 /**
- * A secret entry stored in the vault (in-memory representation).
+ * A symmetric secret entry stored in the vault (in-memory representation).
+ * Holds the raw key material directly — for `'encryption-key'` it is a 32-byte
+ * AES-256 key; for `'api-key'` it is the UTF-8 encoded API key string.
  * @public
  */
-export interface IKeyStoreSecretEntry {
+export interface IKeyStoreSymmetricEntry {
     /**
      * Unique name for this secret (used as lookup key).
      */
     readonly name: string;
     /**
-     * Secret type discriminator.
-     * Defaults to `'encryption-key'` for backwards compatibility.
+     * Symmetric secret type discriminator.
      */
-    readonly type: KeyStoreSecretType;
+    readonly type: KeyStoreSymmetricSecretType;
     /**
      * The secret data.
      * - For `'encryption-key'`: 32-byte AES-256 key.
      * - For `'api-key'`: UTF-8 encoded API key string (arbitrary length).
+     * - For `'opaque'`: arbitrary raw bytes, stored and returned verbatim.
      */
     readonly key: Uint8Array;
     /**
      * Optional description for this secret.
      */
     readonly description?: string;
+    /**
+     * Optional mutable, non-secret-by-contract metadata for this entry. Set via
+     * {@link CryptoUtils.KeyStore.KeyStore.setSecretMetadata} without touching the
+     * secret `key` bytes.
+     *
+     * "Non-secret by contract" means the field is intended for lifecycle metadata
+     * (rotation timestamps, labels, provenance) rather than secret material.
+     * PHYSICALLY it lives inside the vault's AES-GCM ciphertext alongside the key
+     * bytes — the vault has no plaintext index — so it is protected at rest by the
+     * master password; the "non-secret" designation is a usage contract, not a
+     * weaker custody class.
+     */
+    readonly metadata?: JsonValue;
     /**
      * When this secret was added (ISO 8601).
      */
     readonly createdAt: string;
+    /**
+     * When this entry was last mutated (ISO 8601). Stamped on any metadata
+     * mutation (see {@link CryptoUtils.KeyStore.KeyStore.setSecretMetadata}).
+     * Absent on entries that have never been mutated since creation.
+     */
+    readonly updatedAt?: string;
+}
+/**
+ * An asymmetric keypair entry stored in the vault (in-memory representation).
+ * Holds only the public key (as a JWK) and a stable handle (`id`) the
+ * {@link CryptoUtils.KeyStore.IPrivateKeyStorage} provider uses to fetch the private key.
+ * @public
+ */
+export interface IKeyStoreAsymmetricEntry {
+    /**
+     * Unique name for this entry (used as vault lookup key, renameable).
+     */
+    readonly name: string;
+    /**
+     * Asymmetric secret type discriminator.
+     */
+    readonly type: KeyStoreAsymmetricSecretType;
+    /**
+     * Immutable handle used by {@link CryptoUtils.KeyStore.IPrivateKeyStorage} to address the
+     * private key. Independent of `name`; survives renames.
+     */
+    readonly id: string;
+    /**
+     * Algorithm used to generate this keypair.
+     */
+    readonly algorithm: KeyPairAlgorithm;
+    /**
+     * The public key as a JSON Web Key.
+     */
+    readonly publicKeyJwk: JsonWebKey;
+    /**
+     * Optional escrowed copy of the private key, as a JSON Web Key. Present only
+     * when the entry was created with `addKeyPair(name, { escrow: true })`.
+     *
+     * This is an opt-in cross-device recovery affordance: the private key is
+     * carried inside the vault's AES-GCM ciphertext (same custody class as
+     * `publicKeyJwk`), so a recovered vault plus the master password can
+     * reconstitute the signing/decryption identity on a fresh device via
+     * `getKeyPair(name, { rehydrate: true })`.
+     *
+     * SECURITY: when present, the master password becomes the sole gate
+     * protecting this private key. Use a strong KDF for escrow-bearing stores.
+     * See the {@link CryptoUtils.KeyStore.KeyStore} class docs.
+     */
+    readonly escrowedPrivateKeyJwk?: JsonWebKey;
+    /**
+     * Optional description for this entry.
+     */
+    readonly description?: string;
+    /**
+     * When this entry was added (ISO 8601).
+     */
+    readonly createdAt: string;
 }
 /**
- * JSON-serializable version of secret entry (for storage).
+ * Any vault entry, discriminated by `type`.
+ * @public
+ */
+export type IKeyStoreEntry = IKeyStoreSymmetricEntry | IKeyStoreAsymmetricEntry;
+/**
+ * Backwards-compatible alias for {@link CryptoUtils.KeyStore.IKeyStoreSymmetricEntry}.
+ * @deprecated Use {@link CryptoUtils.KeyStore.IKeyStoreSymmetricEntry} for symmetric
+ * entries or {@link CryptoUtils.KeyStore.IKeyStoreEntry} for the discriminated union.
  * @public
  */
-export interface IKeyStoreSecretEntryJson {
+export type IKeyStoreSecretEntry = IKeyStoreSymmetricEntry;
+/**
+ * JSON-serializable representation of a symmetric secret entry.
+ *
+ * @remarks
+ * Describes the *normalized* shape after parsing. `type` is required here
+ * because the converter (see
+ * {@link CryptoUtils.KeyStore.Converters.keystoreSymmetricEntryJson | keystoreSymmetricEntryJson})
+ * injects the default `'encryption-key'` when reading vaults written before
+ * asymmetric-keypair support added the discriminator. Raw on-wire bytes from
+ * a legacy vault may therefore omit `type`; downstream code only ever sees
+ * the post-conversion shape declared here.
+ *
+ * @public
+ */
+export interface IKeyStoreSymmetricEntryJson {
     /**
      * Unique name for this secret.
      */
     readonly name: string;
     /**
-     * Secret type discriminator.
-     * Optional for backwards compatibility — missing means `'encryption-key'`.
+     * Symmetric secret type discriminator.
+     *
+     * Required on this normalized model type. Vaults written prior to the
+     * asymmetric-keypair support may omit this field on the wire; the
+     * converter injects `'encryption-key'` when missing for backwards
+     * compatibility, so by the time a value of this type is observed the
+     * discriminator is always present.
      */
-    readonly type?: KeyStoreSecretType;
+    readonly type: KeyStoreSymmetricSecretType;
     /**
      * Base64-encoded secret data.
      */
@@ -83,13 +229,81 @@ export interface IKeyStoreSecretEntryJson {
      * Optional description.
      */
     readonly description?: string;
+    /**
+     * Optional mutable, non-secret-by-contract metadata for this entry. Present
+     * only on `'keystore-v3'` vaults whose entry carried metadata; a v1/v2 vault
+     * omits the field. Physically carried inside the vault ciphertext (the vault
+     * has no plaintext index).
+     */
+    readonly metadata?: JsonValue;
     /**
      * When this secret was added (ISO 8601).
      */
     readonly createdAt: string;
+    /**
+     * When this entry was last mutated (ISO 8601). Present only on `'keystore-v3'`
+     * vaults whose entry has been mutated since creation.
+     */
+    readonly updatedAt?: string;
 }
 /**
- * The decrypted vault contents - a versioned map of secrets.
+ * JSON-serializable representation of an asymmetric keypair entry.
+ * The private key is not present here — it lives in the
+ * {@link CryptoUtils.KeyStore.IPrivateKeyStorage} provider, addressed by `id`.
+ * @public
+ */
+export interface IKeyStoreAsymmetricEntryJson {
+    /**
+     * Unique name for this entry.
+     */
+    readonly name: string;
+    /**
+     * Asymmetric secret type discriminator.
+     */
+    readonly type: KeyStoreAsymmetricSecretType;
+    /**
+     * Immutable handle used by {@link CryptoUtils.KeyStore.IPrivateKeyStorage} to address the
+     * private key.
+     */
+    readonly id: string;
+    /**
+     * Algorithm used to generate this keypair.
+     */
+    readonly algorithm: KeyPairAlgorithm;
+    /**
+     * The public key as a JSON Web Key.
+     */
+    readonly publicKeyJwk: JsonWebKey;
+    /**
+     * Optional escrowed copy of the private key, as a JSON Web Key. Present only
+     * on `'keystore-v2'` vaults whose entry was created with escrow enabled. A
+     * v1 vault omits the field; a v2 reader treats its absence as "no escrow".
+     */
+    readonly escrowedPrivateKeyJwk?: JsonWebKey;
+    /**
+     * Optional description.
+     */
+    readonly description?: string;
+    /**
+     * When this entry was added (ISO 8601).
+     */
+    readonly createdAt: string;
+}
+/**
+ * Any JSON vault entry, discriminated by `type`.
+ * @public
+ */
+export type IKeyStoreEntryJson = IKeyStoreSymmetricEntryJson | IKeyStoreAsymmetricEntryJson;
+/**
+ * Backwards-compatible alias for {@link CryptoUtils.KeyStore.IKeyStoreSymmetricEntryJson}.
+ * @deprecated Use {@link CryptoUtils.KeyStore.IKeyStoreSymmetricEntryJson} for
+ * symmetric entries or {@link CryptoUtils.KeyStore.IKeyStoreEntryJson} for the
+ * discriminated union.
+ * @public
+ */
+export type IKeyStoreSecretEntryJson = IKeyStoreSymmetricEntryJson;
+/**
+ * The decrypted vault contents - a versioned map of entries.
  * @public
  */
 export interface IKeyStoreVaultContents {
@@ -98,9 +312,9 @@ export interface IKeyStoreVaultContents {
      */
     readonly version: KeyStoreFormat;
     /**
-     * Map of secret name to secret entry.
+     * Map of entry name to entry (symmetric or asymmetric).
      */
-    readonly secrets: Record<string, IKeyStoreSecretEntryJson>;
+    readonly secrets: Record<string, IKeyStoreEntryJson>;
 }
 /**
  * The encrypted key store file format.
@@ -128,9 +342,9 @@ export interface IKeyStoreFile {
      */
     readonly encryptedData: string;
     /**
-     * Key derivation parameters (required for key store - always password-derived).
+     * Key derivation parameters for the vault master key (always PBKDF2).
      */
-    readonly keyDerivation: IKeyDerivationParams;
+    readonly keyDerivation: IPbkdf2KeyDerivationParams;
 }
 /**
  * Key store lock state.
@@ -150,6 +364,12 @@ export interface IKeyStoreCreateParams {
      * PBKDF2 iterations (defaults to DEFAULT_KEYSTORE_ITERATIONS).
      */
     readonly iterations?: number;
+    /**
+     * Optional private-key storage backend. Required to use `addKeyPair` /
+     * `getKeyPair`; absent backends still permit opening, listing, and reading
+     * public-key metadata for asymmetric entries.
+     */
+    readonly privateKeyStorage?: IPrivateKeyStorage;
 }
 /**
  * Parameters for opening an existing key store.
@@ -164,6 +384,12 @@ export interface IKeyStoreOpenParams {
      * The encrypted key store file content.
      */
     readonly keystoreFile: IKeyStoreFile;
+    /**
+     * Optional private-key storage backend. Required to use `addKeyPair` /
+     * `getKeyPair`; absent backends still permit opening, listing, and reading
+     * public-key metadata for asymmetric entries.
+     */
+    readonly privateKeyStorage?: IPrivateKeyStorage;
 }
 /**
  * Result of adding a secret to the key store.
@@ -173,11 +399,19 @@ export interface IAddSecretResult {
     /**
      * The secret entry that was added.
      */
-    readonly entry: IKeyStoreSecretEntry;
+    readonly entry: IKeyStoreSymmetricEntry;
     /**
      * Whether this replaced an existing secret.
      */
     readonly replaced: boolean;
+    /**
+     * Best-effort warning from displaced-resource cleanup. Set when this call
+     * replaced an asymmetric-keypair entry but the corresponding
+     * {@link CryptoUtils.KeyStore.IPrivateKeyStorage}.delete failed; the new
+     * entry is still committed and the orphaned blob is left for consumer-side
+     * GC to reconcile.
+     */
+    readonly warning?: string;
 }
 /**
  * Options for adding a secret.
@@ -199,6 +433,30 @@ export interface IImportSecretOptions extends IAddSecretOptions {
      */
     readonly replace?: boolean;
 }
+/**
+ * Options for importing raw key material via {@link KeyStore.importSecret}.
+ * Extends {@link IImportSecretOptions} with a type classification.
+ * @public
+ */
+export interface IImportKeyOptions extends IImportSecretOptions {
+    /**
+     * Symmetric secret type classification for the imported key material.
+     * @defaultValue 'encryption-key'
+     */
+    readonly type?: KeyStoreSymmetricSecretType;
+}
+/**
+ * Options for importing raw opaque bytes via {@link KeyStore.importSecretBytes}.
+ * Extends {@link IImportSecretOptions} with optional initial metadata.
+ * @public
+ */
+export interface IImportSecretBytesOptions extends IImportSecretOptions {
+    /**
+     * Optional initial mutable metadata to store with the entry. Can also be set
+     * or replaced later via {@link KeyStore.setSecretMetadata}.
+     */
+    readonly metadata?: JsonValue;
+}
 /**
  * Options for adding a secret derived from a password.
  * @public
@@ -234,6 +492,131 @@ export interface IAddSecretFromPasswordResult extends IAddSecretResult {
      */
     readonly keyDerivation: IKeyDerivationParams;
 }
+/**
+ * Options for adding an Argon2id password-derived secret.
+ * @public
+ */
+export interface IAddSecretFromPasswordArgon2idOptions {
+    /**
+     * Argon2id parameters. Defaults to {@link CryptoUtils.ARGON2ID_OWASP_MIN}.
+     */
+    readonly params?: IArgon2idParams;
+    /**
+     * Optional description for the secret.
+     */
+    readonly description?: string;
+    /**
+     * Whether to replace an existing secret with the same name.
+     */
+    readonly replace?: boolean;
+}
+/**
+ * Options for adding an asymmetric keypair to the key store.
+ * @public
+ */
+export interface IAddKeyPairOptions {
+    /**
+     * Algorithm to use for the new keypair.
+     */
+    readonly algorithm: KeyPairAlgorithm;
+    /**
+     * Optional description for the entry.
+     */
+    readonly description?: string;
+    /**
+     * Whether to replace an existing entry with the same name.
+     * Replacement mints a fresh storage `id` and best-effort deletes the
+     * displaced storage blob; see the keystore design doc for details.
+     */
+    readonly replace?: boolean;
+    /**
+     * Overrides the storage-backend-derived extractability for this key only.
+     * Omit to keep the default (`!privateKeyStorage.supportsNonExtractable`).
+     * A value the backend cannot honor fails loudly rather than silently
+     * downgrading.
+     */
+    readonly extractable?: boolean;
+    /**
+     * Opt in to private-key escrow. When `true`, an encrypted copy of the
+     * private key (as a JWK) is carried inside the vault entry
+     * (`escrowedPrivateKeyJwk`), enabling cross-device recovery from the vault
+     * file plus the master password alone via
+     * `getKeyPair(name, { rehydrate: true })`.
+     *
+     * Orthogonal to `extractable`: the escrow copy is always captured (the
+     * transient keypair is generated extractable so it can be exported to JWK),
+     * while the LIVE stored key's extractability still follows the normal rule
+     * (`extractable` override, else the backend default). So escrow does not
+     * change how extractable the day-to-day key is — only whether a recovery
+     * copy is retained in the vault.
+     *
+     * @defaultValue false — no escrow copy is written (today's behavior).
+     *
+     * SECURITY: escrow makes the master password the sole gate protecting a
+     * private key that would otherwise be unrecoverable from the vault. Use a
+     * strong KDF (Argon2id-derived or high-iteration PBKDF2) for escrow-bearing
+     * stores. See the {@link CryptoUtils.KeyStore.KeyStore} class docs.
+     */
+    readonly escrow?: boolean;
+}
+/**
+ * Options for retrieving an asymmetric keypair via {@link CryptoUtils.KeyStore.KeyStore.getKeyPair}.
+ * @public
+ */
+export interface IGetKeyPairOptions {
+    /**
+     * Opt in to escrow rehydration. When `true` AND no private-key blob exists
+     * under the entry's storage `id` AND the entry carries an
+     * `escrowedPrivateKeyJwk`, the escrowed JWK is imported (non-extractable
+     * where the backend supports it) and stored under the entry's `id` before
+     * being returned — filling a gap on a fresh device from the recovered vault.
+     *
+     * Fill-a-gap only: an existing storage blob is never overwritten. When a
+     * blob is present it is loaded as usual and the escrow copy is ignored.
+     *
+     * @defaultValue false — today's behavior: load from storage or fail.
+     */
+    readonly rehydrate?: boolean;
+}
+/**
+ * Result of adding an asymmetric keypair to the key store.
+ * @public
+ */
+export interface IAddKeyPairResult {
+    /**
+     * The asymmetric entry that was added.
+     */
+    readonly entry: IKeyStoreAsymmetricEntry;
+    /**
+     * Whether this replaced an existing entry.
+     */
+    readonly replaced: boolean;
+    /**
+     * Best-effort warning from displaced-resource cleanup. Set when this call
+     * replaced a prior entry but the corresponding
+     * {@link CryptoUtils.KeyStore.IPrivateKeyStorage}.delete failed; the new
+     * keypair is still committed and the orphaned blob is left for consumer-side
+     * GC to reconcile.
+     */
+    readonly warning?: string;
+}
+/**
+ * Result of removing a secret from the key store.
+ * @public
+ */
+export interface IRemoveSecretResult {
+    /**
+     * The secret entry that was removed from the vault.
+     */
+    readonly entry: IKeyStoreEntry;
+    /**
+     * Best-effort warning from {@link CryptoUtils.KeyStore.IPrivateKeyStorage}.delete
+     * for asymmetric entries when the storage call failed. The vault entry is
+     * still considered removed and the orphaned blob is left for consumer-side
+     * GC to reconcile.
+     */
+    readonly warning?: string;
+}
 /**
  * Checks if a JSON object appears to be a key store file.
  * Uses the format field as a discriminator.

package/lib/packlets/crypto-utils/keystore/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../../src/packlets/crypto-utils/keystore/model.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAMlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC,cAAc,CAI5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,cAA8B,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAe,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAW,CAAC;AAM1C;;;;;;;;;GASG;AACH,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,aAAa,CAAC,2BAA2B,CAItF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,EAAE,aAAa,CAAC,4BAA4B,CAExF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,2BAA2B,GAAG,4BAA4B,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC,kBAAkB,CAGpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAElC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,uBAAuB,GAAG,wBAAwB,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAElC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,2BAA2B,GAAG,4BAA4B,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACtD;AAMD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC;CACpD;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IAEzC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IAEzC;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,oBAAoB;IAC7D;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,oBAAoB;IACrE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA8B,SAAQ,iBAAiB;IACtE;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAe,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,4BAA6B,SAAQ,gBAAgB;IACpE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IAEzC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMrD"}

package/lib/packlets/crypto-utils/keystore/model.js

@@ -19,13 +19,26 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 // SOFTWARE.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_SECRET_ITERATIONS = exports.allKeyStoreSecretTypes = exports.MIN_SALT_LENGTH = exports.DEFAULT_KEYSTORE_ITERATIONS = exports.KEYSTORE_FORMAT = void 0;
+exports.DEFAULT_SECRET_ITERATIONS = exports.allKeyStoreSecretTypes = exports.allKeyStoreAsymmetricSecretTypes = exports.allKeyStoreSymmetricSecretTypes = exports.MIN_SALT_LENGTH = exports.DEFAULT_KEYSTORE_ITERATIONS = exports.KEYSTORE_FORMAT = exports.allKeyStoreFormats = exports.allKeyPairAlgorithms = void 0;
 exports.isKeyStoreFile = isKeyStoreFile;
+// Re-export so consumers can continue to access the algorithm enum via the
+// CryptoUtils.KeyStore namespace alongside the rest of the keystore types.
+var model_1 = require("../model");
+Object.defineProperty(exports, "allKeyPairAlgorithms", { enumerable: true, get: function () { return model_1.allKeyPairAlgorithms; } });
 /**
- * Current format version constant.
+ * All recognized key store format versions (readable by the current library).
  * @public
  */
-exports.KEYSTORE_FORMAT = 'keystore-v1';
+exports.allKeyStoreFormats = [
+    'keystore-v1',
+    'keystore-v2',
+    'keystore-v3'
+];
+/**
+ * Current format version constant. New vaults are written as `'keystore-v3'`.
+ * @public
+ */
+exports.KEYSTORE_FORMAT = 'keystore-v3';
 /**
  * Default PBKDF2 iterations for key store encryption.
  * Higher than regular files since this protects the master key vault.
@@ -37,11 +50,30 @@ exports.DEFAULT_KEYSTORE_ITERATIONS = 600000;
  * @public
  */
 exports.MIN_SALT_LENGTH = 16;
+/**
+ * All valid symmetric secret types.
+ * @public
+ */
+exports.allKeyStoreSymmetricSecretTypes = [
+    'encryption-key',
+    'api-key',
+    'opaque'
+];
+/**
+ * All valid asymmetric secret types.
+ * @public
+ */
+exports.allKeyStoreAsymmetricSecretTypes = [
+    'asymmetric-keypair'
+];
 /**
  * All valid key store secret types.
  * @public
  */
-exports.allKeyStoreSecretTypes = ['encryption-key', 'api-key'];
+exports.allKeyStoreSecretTypes = [
+    ...exports.allKeyStoreAsymmetricSecretTypes,
+    ...exports.allKeyStoreSymmetricSecretTypes
+];
 /**
  * Default PBKDF2 iterations for secret-level key derivation.
  * Lower than keystore encryption since these are used more frequently.
@@ -63,6 +95,6 @@ function isKeyStoreFile(json) {
         return false;
     }
     const obj = json;
-    return obj.format === exports.KEYSTORE_FORMAT;
+    return typeof obj.format === 'string' && exports.allKeyStoreFormats.includes(obj.format);
 }
 //# sourceMappingURL=model.js.map