@getstrata/core 2.2.10 → 2.2.12

package/dist/entries/crypto/fieldEncryption.js

@@ -26,7 +26,7 @@ function isFieldEncryptionEnabled() {
   if (featureFlag === "true") {
     return true;
   }
-  return Boolean(resolveEncryptionKey());
+  return Boolean(resolveFieldEncryptionKeyring() || resolveEncryptionKey());
 }
 function encryptField(plaintext, key) {
   const iv = randomBytes(IV_LENGTH);
@@ -56,6 +56,13 @@ function normalizeEmail(email) {
 }
 function protectEmail(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled()) {
+    return {
+      storedEmail: configured.encrypt(normalized, "email"),
+      emailLookup: configured.keyring.lookup(normalized)
+    };
+  }
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return { storedEmail: normalized, emailLookup: normalized };
@@ -66,6 +73,11 @@ function protectEmail(email) {
   };
 }
 function revealEmail(storedEmail) {
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && storedEmail.startsWith("enc:"))
+    return configured.keyring.decrypt(storedEmail, "email");
+  if (storedEmail.startsWith("enc:") && !storedEmail.startsWith(ENCRYPTION_PREFIX))
+    throw new Error("Identified encrypted fields require KMS_ENCRYPTION_KEYRING.");
   const key = resolveEncryptionKey();
   if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
     return storedEmail;
@@ -74,13 +86,144 @@ function revealEmail(storedEmail) {
 }
 function emailLookupForQuery(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled())
+    return configured.keyring.lookup(normalized);
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return normalized;
   }
   return hashLookupValue(normalized, key);
 }
+function createFieldEncryptionKeyring(options) {
+  const identifier = /^[A-Za-z0-9_-]{1,64}$/;
+  const copyKey = (value) => {
+    if (!(value instanceof Uint8Array) || value.byteLength !== 32)
+      throw new TypeError("Field encryption keys must be 32 bytes.");
+    return Buffer.from(value);
+  };
+  const entries = Object.entries(options.encryptionKeys);
+  if (entries.length < 1 || entries.length > 32)
+    throw new TypeError("Field encryption keyrings require 1 to 32 keys.");
+  const keys = new Map;
+  for (const [id, key] of entries) {
+    if (!identifier.test(id))
+      throw new TypeError("Invalid field encryption key identifier.");
+    keys.set(id, copyKey(key));
+  }
+  const activeKeyId = options.activeKeyId;
+  const active = keys.get(activeKeyId);
+  if (!active)
+    throw new TypeError("Active field encryption key is not retained.");
+  const legacy = options.legacyV1Key === undefined ? undefined : copyKey(options.legacyV1Key);
+  const lookup = copyKey(options.lookupKey);
+  const associatedData = (id, purpose) => {
+    if (!identifier.test(purpose))
+      throw new TypeError("Invalid field encryption purpose.");
+    return Buffer.from(`strata:field:v2:${id}:${purpose}`, "utf8");
+  };
+  const decodePayload = (encoded) => {
+    const payload = Buffer.from(encoded, "base64");
+    if (payload.length < IV_LENGTH + TAG_LENGTH || payload.toString("base64") !== encoded)
+      throw new Error("Invalid encrypted field.");
+    return payload;
+  };
+  return Object.freeze({
+    activeKeyId,
+    encrypt(plaintext, purpose) {
+      const aad = associatedData(activeKeyId, purpose);
+      const iv = randomBytes(IV_LENGTH);
+      const cipher = createCipheriv("aes-256-gcm", active, iv, { authTagLength: TAG_LENGTH });
+      cipher.setAAD(aad);
+      const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+      const payload = Buffer.concat([iv, ciphertext, cipher.getAuthTag()]).toString("base64");
+      return `enc:v2:${activeKeyId}:${payload}`;
+    },
+    decrypt(value, purpose) {
+      associatedData(activeKeyId, purpose);
+      try {
+        if (value.startsWith(ENCRYPTION_PREFIX)) {
+          if (!legacy)
+            throw new Error("Missing legacy key");
+          decodePayload(value.slice(ENCRYPTION_PREFIX.length));
+          return decryptField(value, legacy);
+        }
+        const parts = value.split(":");
+        if (parts.length !== 4 || parts[0] !== "enc" || parts[1] !== "v2")
+          throw new Error("Invalid envelope");
+        const id = parts[2] ?? "";
+        const key = keys.get(id);
+        if (!key)
+          throw new Error("Missing retained key");
+        const payload = decodePayload(parts[3] ?? "");
+        const decipher = createDecipheriv("aes-256-gcm", key, payload.subarray(0, IV_LENGTH), {
+          authTagLength: TAG_LENGTH
+        });
+        decipher.setAAD(associatedData(id, purpose));
+        decipher.setAuthTag(payload.subarray(payload.length - TAG_LENGTH));
+        return Buffer.concat([
+          decipher.update(payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH)),
+          decipher.final()
+        ]).toString("utf8");
+      } catch {
+        throw new Error("Unable to decrypt encrypted field.");
+      }
+    },
+    lookup(normalizedValue) {
+      return hashLookupValue(normalizedValue, lookup);
+    }
+  });
+}
+function resolveFieldEncryptionKeyring(env = process.env) {
+  const raw = env.KMS_ENCRYPTION_KEYRING;
+  if (raw === undefined)
+    return null;
+  try {
+    if (!raw.trim() || raw.length > 16384 || env.KMS_ENCRYPTION_KEY?.trim())
+      throw new Error("Invalid configuration");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("Invalid configuration");
+    const config = parsed;
+    if (Object.keys(config).some((key) => !["activeKeyId", "encryptionKeys", "legacyV1Key", "lookupKey", "writeVersion"].includes(key)))
+      throw new Error("Unknown option");
+    if (typeof config.activeKeyId !== "string" || config.writeVersion !== 1 && config.writeVersion !== 2 || !config.encryptionKeys || typeof config.encryptionKeys !== "object" || Array.isArray(config.encryptionKeys))
+      throw new Error("Invalid configuration");
+    const decodeKey = (value) => {
+      if (typeof value !== "string")
+        throw new Error("Invalid key");
+      if (/^[0-9a-f]{64}$/i.test(value))
+        return Buffer.from(value, "hex");
+      const decoded = Buffer.from(value, "base64");
+      if (decoded.length !== 32 || decoded.toString("base64") !== value)
+        throw new Error("Invalid key");
+      return decoded;
+    };
+    const keys = Object.fromEntries(Object.entries(config.encryptionKeys).map(([id, value]) => [id, decodeKey(value)]));
+    const legacy = config.legacyV1Key === undefined ? undefined : decodeKey(config.legacyV1Key);
+    const lookup = decodeKey(config.lookupKey);
+    if (config.writeVersion === 1 && !legacy || legacy && !legacy.equals(lookup))
+      throw new Error("Incompatible lookup key");
+    const keyring = createFieldEncryptionKeyring({
+      activeKeyId: config.activeKeyId,
+      encryptionKeys: keys,
+      legacyV1Key: legacy,
+      lookupKey: lookup
+    });
+    const writeVersion = config.writeVersion;
+    return Object.freeze({
+      keyring,
+      writeVersion,
+      encrypt(plaintext, purpose) {
+        return writeVersion === 1 && legacy ? encryptField(plaintext, legacy) : keyring.encrypt(plaintext, purpose);
+      }
+    });
+  } catch {
+    throw new Error("Invalid KMS_ENCRYPTION_KEYRING configuration.");
+  }
+}
 export {
+  createFieldEncryptionKeyring,
   decryptField,
   emailLookupForQuery,
   encryptField,
@@ -89,5 +232,6 @@ export {
   normalizeEmail,
   protectEmail,
   resolveEncryptionKey,
+  resolveFieldEncryptionKeyring,
   revealEmail
 };

package/dist/entries/crypto/fieldEncryptionRotation.js

@@ -0,0 +1 @@
+export * from "../../index.js";

package/dist/entries/crypto/mfaSecret.js

@@ -46,7 +46,7 @@ function isFieldEncryptionEnabled() {
   if (featureFlag === "true") {
     return true;
   }
-  return Boolean(resolveEncryptionKey());
+  return Boolean(resolveFieldEncryptionKeyring() || resolveEncryptionKey());
 }
 function encryptField(plaintext, key) {
   const iv = randomBytes(IV_LENGTH);
@@ -76,6 +76,13 @@ function normalizeEmail(email) {
 }
 function protectEmail(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled()) {
+    return {
+      storedEmail: configured.encrypt(normalized, "email"),
+      emailLookup: configured.keyring.lookup(normalized)
+    };
+  }
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return { storedEmail: normalized, emailLookup: normalized };
@@ -86,6 +93,11 @@ function protectEmail(email) {
   };
 }
 function revealEmail(storedEmail) {
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && storedEmail.startsWith("enc:"))
+    return configured.keyring.decrypt(storedEmail, "email");
+  if (storedEmail.startsWith("enc:") && !storedEmail.startsWith(ENCRYPTION_PREFIX))
+    throw new Error("Identified encrypted fields require KMS_ENCRYPTION_KEYRING.");
   const key = resolveEncryptionKey();
   if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
     return storedEmail;
@@ -94,15 +106,148 @@ function revealEmail(storedEmail) {
 }
 function emailLookupForQuery(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled())
+    return configured.keyring.lookup(normalized);
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return normalized;
   }
   return hashLookupValue(normalized, key);
 }
+function createFieldEncryptionKeyring(options) {
+  const identifier = /^[A-Za-z0-9_-]{1,64}$/;
+  const copyKey = (value) => {
+    if (!(value instanceof Uint8Array) || value.byteLength !== 32)
+      throw new TypeError("Field encryption keys must be 32 bytes.");
+    return Buffer.from(value);
+  };
+  const entries = Object.entries(options.encryptionKeys);
+  if (entries.length < 1 || entries.length > 32)
+    throw new TypeError("Field encryption keyrings require 1 to 32 keys.");
+  const keys = new Map;
+  for (const [id, key] of entries) {
+    if (!identifier.test(id))
+      throw new TypeError("Invalid field encryption key identifier.");
+    keys.set(id, copyKey(key));
+  }
+  const activeKeyId = options.activeKeyId;
+  const active = keys.get(activeKeyId);
+  if (!active)
+    throw new TypeError("Active field encryption key is not retained.");
+  const legacy = options.legacyV1Key === undefined ? undefined : copyKey(options.legacyV1Key);
+  const lookup = copyKey(options.lookupKey);
+  const associatedData = (id, purpose) => {
+    if (!identifier.test(purpose))
+      throw new TypeError("Invalid field encryption purpose.");
+    return Buffer.from(`strata:field:v2:${id}:${purpose}`, "utf8");
+  };
+  const decodePayload = (encoded) => {
+    const payload = Buffer.from(encoded, "base64");
+    if (payload.length < IV_LENGTH + TAG_LENGTH || payload.toString("base64") !== encoded)
+      throw new Error("Invalid encrypted field.");
+    return payload;
+  };
+  return Object.freeze({
+    activeKeyId,
+    encrypt(plaintext, purpose) {
+      const aad = associatedData(activeKeyId, purpose);
+      const iv = randomBytes(IV_LENGTH);
+      const cipher = createCipheriv("aes-256-gcm", active, iv, { authTagLength: TAG_LENGTH });
+      cipher.setAAD(aad);
+      const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+      const payload = Buffer.concat([iv, ciphertext, cipher.getAuthTag()]).toString("base64");
+      return `enc:v2:${activeKeyId}:${payload}`;
+    },
+    decrypt(value, purpose) {
+      associatedData(activeKeyId, purpose);
+      try {
+        if (value.startsWith(ENCRYPTION_PREFIX)) {
+          if (!legacy)
+            throw new Error("Missing legacy key");
+          decodePayload(value.slice(ENCRYPTION_PREFIX.length));
+          return decryptField(value, legacy);
+        }
+        const parts = value.split(":");
+        if (parts.length !== 4 || parts[0] !== "enc" || parts[1] !== "v2")
+          throw new Error("Invalid envelope");
+        const id = parts[2] ?? "";
+        const key = keys.get(id);
+        if (!key)
+          throw new Error("Missing retained key");
+        const payload = decodePayload(parts[3] ?? "");
+        const decipher = createDecipheriv("aes-256-gcm", key, payload.subarray(0, IV_LENGTH), {
+          authTagLength: TAG_LENGTH
+        });
+        decipher.setAAD(associatedData(id, purpose));
+        decipher.setAuthTag(payload.subarray(payload.length - TAG_LENGTH));
+        return Buffer.concat([
+          decipher.update(payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH)),
+          decipher.final()
+        ]).toString("utf8");
+      } catch {
+        throw new Error("Unable to decrypt encrypted field.");
+      }
+    },
+    lookup(normalizedValue) {
+      return hashLookupValue(normalizedValue, lookup);
+    }
+  });
+}
+function resolveFieldEncryptionKeyring(env = process.env) {
+  const raw = env.KMS_ENCRYPTION_KEYRING;
+  if (raw === undefined)
+    return null;
+  try {
+    if (!raw.trim() || raw.length > 16384 || env.KMS_ENCRYPTION_KEY?.trim())
+      throw new Error("Invalid configuration");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("Invalid configuration");
+    const config = parsed;
+    if (Object.keys(config).some((key) => !["activeKeyId", "encryptionKeys", "legacyV1Key", "lookupKey", "writeVersion"].includes(key)))
+      throw new Error("Unknown option");
+    if (typeof config.activeKeyId !== "string" || config.writeVersion !== 1 && config.writeVersion !== 2 || !config.encryptionKeys || typeof config.encryptionKeys !== "object" || Array.isArray(config.encryptionKeys))
+      throw new Error("Invalid configuration");
+    const decodeKey = (value) => {
+      if (typeof value !== "string")
+        throw new Error("Invalid key");
+      if (/^[0-9a-f]{64}$/i.test(value))
+        return Buffer.from(value, "hex");
+      const decoded = Buffer.from(value, "base64");
+      if (decoded.length !== 32 || decoded.toString("base64") !== value)
+        throw new Error("Invalid key");
+      return decoded;
+    };
+    const keys = Object.fromEntries(Object.entries(config.encryptionKeys).map(([id, value]) => [id, decodeKey(value)]));
+    const legacy = config.legacyV1Key === undefined ? undefined : decodeKey(config.legacyV1Key);
+    const lookup = decodeKey(config.lookupKey);
+    if (config.writeVersion === 1 && !legacy || legacy && !legacy.equals(lookup))
+      throw new Error("Incompatible lookup key");
+    const keyring = createFieldEncryptionKeyring({
+      activeKeyId: config.activeKeyId,
+      encryptionKeys: keys,
+      legacyV1Key: legacy,
+      lookupKey: lookup
+    });
+    const writeVersion = config.writeVersion;
+    return Object.freeze({
+      keyring,
+      writeVersion,
+      encrypt(plaintext, purpose) {
+        return writeVersion === 1 && legacy ? encryptField(plaintext, legacy) : keyring.encrypt(plaintext, purpose);
+      }
+    });
+  } catch {
+    throw new Error("Invalid KMS_ENCRYPTION_KEYRING configuration.");
+  }
+}
 
 // ../../src/core/crypto/mfaSecret.ts
 function protectMfaSecret(secret) {
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured)
+    return configured.encrypt(secret, "mfa");
   const key = resolveEncryptionKey();
   if (!key) {
     throw new Error("MFA secrets require KMS_ENCRYPTION_KEY.");
@@ -113,6 +258,14 @@ function revealMfaSecret(stored) {
   if (!stored) {
     return null;
   }
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured) {
+    if (!stored.startsWith("enc:"))
+      throw new Error("MFA secrets must be encrypted.");
+    return configured.keyring.decrypt(stored, "mfa");
+  }
+  if (stored.startsWith("enc:") && !stored.startsWith("enc:v1:"))
+    throw new Error("Identified MFA secrets require KMS_ENCRYPTION_KEYRING.");
   if (!stored.startsWith("enc:v1:")) {
     if (isProductionEnv() || resolveEncryptionKey()) {
       throw new Error("MFA secrets must be encrypted.");

package/dist/entries/database/schema.js

@@ -694,10 +694,10 @@ function compileColumn(driver, column, mode) {
     parts[1] = `${parts[1]} AUTO_INCREMENT`;
   }
   if (column.isPrimary && mode === "create") {
-    if (driver === "sqlite") {
+    if (driver === "sqlite" && column.autoIncrement) {
       parts.push("PRIMARY KEY AUTOINCREMENT");
     } else {
-      parts.push("PRIMARY KEY");
+      parts.push(driver === "sqlite" && !column.isNullable ? "PRIMARY KEY NOT NULL" : "PRIMARY KEY");
     }
   } else if (!column.isNullable) {
     parts.push("NOT NULL");

package/dist/entries/database/sqliteConnection.js

@@ -45,6 +45,126 @@ var init_connectionContext = __esm(() => {
 // ../../src/core/database/sqliteConnection.ts
 init_connectionContext();
 import { Database } from "bun:sqlite";
+import { resolve } from "path";
+
+// ../../src/core/database/isolatedReadOnlyObservation.ts
+var childSource = `
+import { Database } from 'bun:sqlite';
+let db;
+let mysql;
+process.on('message', async message => {
+  try {
+    if (message.init) {
+      if (message.driver === 'mysql') {
+        const module = await import(message.module);
+        mysql = await module.createConnection({ uri: message.url, timezone: 'Z', connectTimeout: message.timeoutMs });
+        await mysql.query("SET time_zone = '+00:00'");
+        await mysql.query('SET SESSION max_execution_time = ' + message.timeoutMs);
+        await mysql.query('SET SESSION lock_wait_timeout = 1');
+        await mysql.query('SET TRANSACTION ISOLATION LEVEL REPEATABLE READ');
+        await mysql.query('START TRANSACTION READ ONLY');
+      } else {
+        db = new Database(message.filename, { readonly: true, create: false });
+        db.exec('PRAGMA busy_timeout = 0');
+        db.exec('PRAGMA query_only = ON');
+        db.exec('BEGIN');
+      }
+      process.send({ ok: true, rows: [] });
+    } else {
+      const rows = mysql ? (message.params.length ? await mysql.execute(message.query, message.params) : await mysql.query(message.query))[0] : db.query(message.query).all(...message.params);
+      process.send({ ok: true, rows });
+    }
+  } catch {
+    // No SQL, file paths, payloads or driver exception text crosses the error channel.
+    process.send({ ok: false });
+  }
+});
+`;
+async function observeIsolatedReadOnly(profile, operation, options) {
+  options.signal.throwIfAborted();
+  if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 5000)
+    throw new TypeError("SQL observation timeout must be between 1 and 5000 milliseconds.");
+  const executable = Bun.which("bun", { PATH: process.env.PATH ?? "" });
+  if (!executable)
+    throw new Error("SQL observations require the Bun CLI on PATH.");
+  let pending;
+  let stopped = false;
+  const { promise: aborted, reject: rejectAbort } = Promise.withResolvers();
+  const fail = (error) => {
+    pending?.reject(error);
+    pending = undefined;
+  };
+  const child = Bun.spawn({
+    cmd: [
+      executable,
+      "--no-env-file",
+      `--config=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
+      "-e",
+      childSource
+    ],
+    env: {},
+    stdout: "ignore",
+    stderr: "ignore",
+    serialization: "advanced",
+    ipc(message) {
+      const response = message;
+      const request = pending;
+      pending = undefined;
+      if (response?.ok === true && Array.isArray(response.rows))
+        request?.resolve(response.rows);
+      else
+        request?.reject(new Error("Read-only SQL observation failed."));
+    }
+  });
+  const exited = child.exited.then(() => {
+    fail(new Error("SQL observation process exited."));
+  });
+  const abort = (reason) => {
+    stopped = true;
+    child.kill("SIGKILL");
+    fail(reason);
+    rejectAbort(reason);
+  };
+  const onAbort = () => abort(options.signal.reason);
+  options.signal.addEventListener("abort", onAbort, { once: true });
+  const timer = setTimeout(() => abort(new Error("SQL observation timed out.")), options.timeoutMs);
+  const request = (message) => {
+    if (stopped)
+      return Promise.reject(new Error("SQL observation is closed."));
+    if (pending)
+      return Promise.reject(new Error("Concurrent SQL observation queries are not supported."));
+    return new Promise((resolve, reject) => {
+      pending = { resolve, reject };
+      child.send(message);
+    });
+  };
+  try {
+    if (options.signal.aborted)
+      onAbort();
+    const work = (async () => {
+      await request({ init: true, ...profile, timeoutMs: options.timeoutMs });
+      options.signal.throwIfAborted();
+      return operation({
+        async unsafe(query, params = []) {
+          return await request({
+            query,
+            params: params.map((value) => profile.driver === "sqlite" && value instanceof Date ? value.toISOString() : value)
+          });
+        }
+      });
+    })();
+    return await Promise.race([work, aborted]);
+  } finally {
+    stopped = true;
+    clearTimeout(timer);
+    options.signal.removeEventListener("abort", onAbort);
+    child.kill("SIGKILL");
+    fail(new Error("SQL observation is closed."));
+    await exited;
+  }
+}
+
+// ../../src/core/database/sqliteConnection.ts
 function isRowReturning(sql) {
   const upper = sql.replace(/\s+/g, " ").trim().toUpperCase();
   if (upper.includes(" RETURNING ")) {
@@ -56,7 +176,8 @@ function createSqliteConnection(filename) {
   if (!filename.trim()) {
     throw new Error("SQLite path is not configured. Pass a filename or :memory:.");
   }
-  const db = new Database(filename, { create: true });
+  const absoluteFilename = filename === ":memory:" ? filename : resolve(filename);
+  const db = new Database(absoluteFilename, { create: true });
   db.exec("PRAGMA foreign_keys = ON");
   db.exec("PRAGMA busy_timeout = 5000");
   if (filename !== ":memory:") {
@@ -119,6 +240,21 @@ function createSqliteConnection(filename) {
         }
       });
     },
+    async observeReadOnly(operation, options) {
+      if (closed)
+        throw new Error("SQLite connection is closed.");
+      if (absoluteFilename === ":memory:")
+        throw new Error("SQL observations require file-backed SQLite.");
+      pending++;
+      try {
+        return await observeIsolatedReadOnly({ driver: "sqlite", filename: absoluteFilename }, async (transaction) => {
+          transactions.add(transaction);
+          return await runWithDatabaseConnection(transaction, () => operation(transaction));
+        }, options);
+      } finally {
+        pending--;
+      }
+    },
     close() {
       if (pending > 0)
         throw new Error("Drain SQLite operations before closing the connection.");