@getstrata/core 2.2.11 → 2.2.13

package/dist/entries/crypto/fieldEncryption.js

@@ -26,7 +26,7 @@ function isFieldEncryptionEnabled() {
   if (featureFlag === "true") {
     return true;
   }
-  return Boolean(resolveEncryptionKey());
+  return Boolean(resolveFieldEncryptionKeyring() || resolveEncryptionKey());
 }
 function encryptField(plaintext, key) {
   const iv = randomBytes(IV_LENGTH);
@@ -56,6 +56,13 @@ function normalizeEmail(email) {
 }
 function protectEmail(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled()) {
+    return {
+      storedEmail: configured.encrypt(normalized, "email"),
+      emailLookup: configured.keyring.lookup(normalized)
+    };
+  }
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return { storedEmail: normalized, emailLookup: normalized };
@@ -66,6 +73,11 @@ function protectEmail(email) {
   };
 }
 function revealEmail(storedEmail) {
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && storedEmail.startsWith("enc:"))
+    return configured.keyring.decrypt(storedEmail, "email");
+  if (storedEmail.startsWith("enc:") && !storedEmail.startsWith(ENCRYPTION_PREFIX))
+    throw new Error("Identified encrypted fields require KMS_ENCRYPTION_KEYRING.");
   const key = resolveEncryptionKey();
   if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
     return storedEmail;
@@ -74,13 +86,144 @@ function revealEmail(storedEmail) {
 }
 function emailLookupForQuery(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled())
+    return configured.keyring.lookup(normalized);
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return normalized;
   }
   return hashLookupValue(normalized, key);
 }
+function createFieldEncryptionKeyring(options) {
+  const identifier = /^[A-Za-z0-9_-]{1,64}$/;
+  const copyKey = (value) => {
+    if (!(value instanceof Uint8Array) || value.byteLength !== 32)
+      throw new TypeError("Field encryption keys must be 32 bytes.");
+    return Buffer.from(value);
+  };
+  const entries = Object.entries(options.encryptionKeys);
+  if (entries.length < 1 || entries.length > 32)
+    throw new TypeError("Field encryption keyrings require 1 to 32 keys.");
+  const keys = new Map;
+  for (const [id, key] of entries) {
+    if (!identifier.test(id))
+      throw new TypeError("Invalid field encryption key identifier.");
+    keys.set(id, copyKey(key));
+  }
+  const activeKeyId = options.activeKeyId;
+  const active = keys.get(activeKeyId);
+  if (!active)
+    throw new TypeError("Active field encryption key is not retained.");
+  const legacy = options.legacyV1Key === undefined ? undefined : copyKey(options.legacyV1Key);
+  const lookup = copyKey(options.lookupKey);
+  const associatedData = (id, purpose) => {
+    if (!identifier.test(purpose))
+      throw new TypeError("Invalid field encryption purpose.");
+    return Buffer.from(`strata:field:v2:${id}:${purpose}`, "utf8");
+  };
+  const decodePayload = (encoded) => {
+    const payload = Buffer.from(encoded, "base64");
+    if (payload.length < IV_LENGTH + TAG_LENGTH || payload.toString("base64") !== encoded)
+      throw new Error("Invalid encrypted field.");
+    return payload;
+  };
+  return Object.freeze({
+    activeKeyId,
+    encrypt(plaintext, purpose) {
+      const aad = associatedData(activeKeyId, purpose);
+      const iv = randomBytes(IV_LENGTH);
+      const cipher = createCipheriv("aes-256-gcm", active, iv, { authTagLength: TAG_LENGTH });
+      cipher.setAAD(aad);
+      const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+      const payload = Buffer.concat([iv, ciphertext, cipher.getAuthTag()]).toString("base64");
+      return `enc:v2:${activeKeyId}:${payload}`;
+    },
+    decrypt(value, purpose) {
+      associatedData(activeKeyId, purpose);
+      try {
+        if (value.startsWith(ENCRYPTION_PREFIX)) {
+          if (!legacy)
+            throw new Error("Missing legacy key");
+          decodePayload(value.slice(ENCRYPTION_PREFIX.length));
+          return decryptField(value, legacy);
+        }
+        const parts = value.split(":");
+        if (parts.length !== 4 || parts[0] !== "enc" || parts[1] !== "v2")
+          throw new Error("Invalid envelope");
+        const id = parts[2] ?? "";
+        const key = keys.get(id);
+        if (!key)
+          throw new Error("Missing retained key");
+        const payload = decodePayload(parts[3] ?? "");
+        const decipher = createDecipheriv("aes-256-gcm", key, payload.subarray(0, IV_LENGTH), {
+          authTagLength: TAG_LENGTH
+        });
+        decipher.setAAD(associatedData(id, purpose));
+        decipher.setAuthTag(payload.subarray(payload.length - TAG_LENGTH));
+        return Buffer.concat([
+          decipher.update(payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH)),
+          decipher.final()
+        ]).toString("utf8");
+      } catch {
+        throw new Error("Unable to decrypt encrypted field.");
+      }
+    },
+    lookup(normalizedValue) {
+      return hashLookupValue(normalizedValue, lookup);
+    }
+  });
+}
+function resolveFieldEncryptionKeyring(env = process.env) {
+  const raw = env.KMS_ENCRYPTION_KEYRING;
+  if (raw === undefined)
+    return null;
+  try {
+    if (!raw.trim() || raw.length > 16384 || env.KMS_ENCRYPTION_KEY?.trim())
+      throw new Error("Invalid configuration");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("Invalid configuration");
+    const config = parsed;
+    if (Object.keys(config).some((key) => !["activeKeyId", "encryptionKeys", "legacyV1Key", "lookupKey", "writeVersion"].includes(key)))
+      throw new Error("Unknown option");
+    if (typeof config.activeKeyId !== "string" || config.writeVersion !== 1 && config.writeVersion !== 2 || !config.encryptionKeys || typeof config.encryptionKeys !== "object" || Array.isArray(config.encryptionKeys))
+      throw new Error("Invalid configuration");
+    const decodeKey = (value) => {
+      if (typeof value !== "string")
+        throw new Error("Invalid key");
+      if (/^[0-9a-f]{64}$/i.test(value))
+        return Buffer.from(value, "hex");
+      const decoded = Buffer.from(value, "base64");
+      if (decoded.length !== 32 || decoded.toString("base64") !== value)
+        throw new Error("Invalid key");
+      return decoded;
+    };
+    const keys = Object.fromEntries(Object.entries(config.encryptionKeys).map(([id, value]) => [id, decodeKey(value)]));
+    const legacy = config.legacyV1Key === undefined ? undefined : decodeKey(config.legacyV1Key);
+    const lookup = decodeKey(config.lookupKey);
+    if (config.writeVersion === 1 && !legacy || legacy && !legacy.equals(lookup))
+      throw new Error("Incompatible lookup key");
+    const keyring = createFieldEncryptionKeyring({
+      activeKeyId: config.activeKeyId,
+      encryptionKeys: keys,
+      legacyV1Key: legacy,
+      lookupKey: lookup
+    });
+    const writeVersion = config.writeVersion;
+    return Object.freeze({
+      keyring,
+      writeVersion,
+      encrypt(plaintext, purpose) {
+        return writeVersion === 1 && legacy ? encryptField(plaintext, legacy) : keyring.encrypt(plaintext, purpose);
+      }
+    });
+  } catch {
+    throw new Error("Invalid KMS_ENCRYPTION_KEYRING configuration.");
+  }
+}
 export {
+  createFieldEncryptionKeyring,
   decryptField,
   emailLookupForQuery,
   encryptField,
@@ -89,5 +232,6 @@ export {
   normalizeEmail,
   protectEmail,
   resolveEncryptionKey,
+  resolveFieldEncryptionKeyring,
   revealEmail
 };

package/dist/entries/crypto/fieldEncryptionRotation.js

@@ -0,0 +1 @@
+export * from "../../index.js";

package/dist/entries/crypto/mfaSecret.js

@@ -46,7 +46,7 @@ function isFieldEncryptionEnabled() {
   if (featureFlag === "true") {
     return true;
   }
-  return Boolean(resolveEncryptionKey());
+  return Boolean(resolveFieldEncryptionKeyring() || resolveEncryptionKey());
 }
 function encryptField(plaintext, key) {
   const iv = randomBytes(IV_LENGTH);
@@ -76,6 +76,13 @@ function normalizeEmail(email) {
 }
 function protectEmail(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled()) {
+    return {
+      storedEmail: configured.encrypt(normalized, "email"),
+      emailLookup: configured.keyring.lookup(normalized)
+    };
+  }
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return { storedEmail: normalized, emailLookup: normalized };
@@ -86,6 +93,11 @@ function protectEmail(email) {
   };
 }
 function revealEmail(storedEmail) {
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && storedEmail.startsWith("enc:"))
+    return configured.keyring.decrypt(storedEmail, "email");
+  if (storedEmail.startsWith("enc:") && !storedEmail.startsWith(ENCRYPTION_PREFIX))
+    throw new Error("Identified encrypted fields require KMS_ENCRYPTION_KEYRING.");
   const key = resolveEncryptionKey();
   if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
     return storedEmail;
@@ -94,15 +106,148 @@ function revealEmail(storedEmail) {
 }
 function emailLookupForQuery(email) {
   const normalized = normalizeEmail(email);
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured && isFieldEncryptionEnabled())
+    return configured.keyring.lookup(normalized);
   const key = resolveEncryptionKey();
   if (!key || !isFieldEncryptionEnabled()) {
     return normalized;
   }
   return hashLookupValue(normalized, key);
 }
+function createFieldEncryptionKeyring(options) {
+  const identifier = /^[A-Za-z0-9_-]{1,64}$/;
+  const copyKey = (value) => {
+    if (!(value instanceof Uint8Array) || value.byteLength !== 32)
+      throw new TypeError("Field encryption keys must be 32 bytes.");
+    return Buffer.from(value);
+  };
+  const entries = Object.entries(options.encryptionKeys);
+  if (entries.length < 1 || entries.length > 32)
+    throw new TypeError("Field encryption keyrings require 1 to 32 keys.");
+  const keys = new Map;
+  for (const [id, key] of entries) {
+    if (!identifier.test(id))
+      throw new TypeError("Invalid field encryption key identifier.");
+    keys.set(id, copyKey(key));
+  }
+  const activeKeyId = options.activeKeyId;
+  const active = keys.get(activeKeyId);
+  if (!active)
+    throw new TypeError("Active field encryption key is not retained.");
+  const legacy = options.legacyV1Key === undefined ? undefined : copyKey(options.legacyV1Key);
+  const lookup = copyKey(options.lookupKey);
+  const associatedData = (id, purpose) => {
+    if (!identifier.test(purpose))
+      throw new TypeError("Invalid field encryption purpose.");
+    return Buffer.from(`strata:field:v2:${id}:${purpose}`, "utf8");
+  };
+  const decodePayload = (encoded) => {
+    const payload = Buffer.from(encoded, "base64");
+    if (payload.length < IV_LENGTH + TAG_LENGTH || payload.toString("base64") !== encoded)
+      throw new Error("Invalid encrypted field.");
+    return payload;
+  };
+  return Object.freeze({
+    activeKeyId,
+    encrypt(plaintext, purpose) {
+      const aad = associatedData(activeKeyId, purpose);
+      const iv = randomBytes(IV_LENGTH);
+      const cipher = createCipheriv("aes-256-gcm", active, iv, { authTagLength: TAG_LENGTH });
+      cipher.setAAD(aad);
+      const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+      const payload = Buffer.concat([iv, ciphertext, cipher.getAuthTag()]).toString("base64");
+      return `enc:v2:${activeKeyId}:${payload}`;
+    },
+    decrypt(value, purpose) {
+      associatedData(activeKeyId, purpose);
+      try {
+        if (value.startsWith(ENCRYPTION_PREFIX)) {
+          if (!legacy)
+            throw new Error("Missing legacy key");
+          decodePayload(value.slice(ENCRYPTION_PREFIX.length));
+          return decryptField(value, legacy);
+        }
+        const parts = value.split(":");
+        if (parts.length !== 4 || parts[0] !== "enc" || parts[1] !== "v2")
+          throw new Error("Invalid envelope");
+        const id = parts[2] ?? "";
+        const key = keys.get(id);
+        if (!key)
+          throw new Error("Missing retained key");
+        const payload = decodePayload(parts[3] ?? "");
+        const decipher = createDecipheriv("aes-256-gcm", key, payload.subarray(0, IV_LENGTH), {
+          authTagLength: TAG_LENGTH
+        });
+        decipher.setAAD(associatedData(id, purpose));
+        decipher.setAuthTag(payload.subarray(payload.length - TAG_LENGTH));
+        return Buffer.concat([
+          decipher.update(payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH)),
+          decipher.final()
+        ]).toString("utf8");
+      } catch {
+        throw new Error("Unable to decrypt encrypted field.");
+      }
+    },
+    lookup(normalizedValue) {
+      return hashLookupValue(normalizedValue, lookup);
+    }
+  });
+}
+function resolveFieldEncryptionKeyring(env = process.env) {
+  const raw = env.KMS_ENCRYPTION_KEYRING;
+  if (raw === undefined)
+    return null;
+  try {
+    if (!raw.trim() || raw.length > 16384 || env.KMS_ENCRYPTION_KEY?.trim())
+      throw new Error("Invalid configuration");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("Invalid configuration");
+    const config = parsed;
+    if (Object.keys(config).some((key) => !["activeKeyId", "encryptionKeys", "legacyV1Key", "lookupKey", "writeVersion"].includes(key)))
+      throw new Error("Unknown option");
+    if (typeof config.activeKeyId !== "string" || config.writeVersion !== 1 && config.writeVersion !== 2 || !config.encryptionKeys || typeof config.encryptionKeys !== "object" || Array.isArray(config.encryptionKeys))
+      throw new Error("Invalid configuration");
+    const decodeKey = (value) => {
+      if (typeof value !== "string")
+        throw new Error("Invalid key");
+      if (/^[0-9a-f]{64}$/i.test(value))
+        return Buffer.from(value, "hex");
+      const decoded = Buffer.from(value, "base64");
+      if (decoded.length !== 32 || decoded.toString("base64") !== value)
+        throw new Error("Invalid key");
+      return decoded;
+    };
+    const keys = Object.fromEntries(Object.entries(config.encryptionKeys).map(([id, value]) => [id, decodeKey(value)]));
+    const legacy = config.legacyV1Key === undefined ? undefined : decodeKey(config.legacyV1Key);
+    const lookup = decodeKey(config.lookupKey);
+    if (config.writeVersion === 1 && !legacy || legacy && !legacy.equals(lookup))
+      throw new Error("Incompatible lookup key");
+    const keyring = createFieldEncryptionKeyring({
+      activeKeyId: config.activeKeyId,
+      encryptionKeys: keys,
+      legacyV1Key: legacy,
+      lookupKey: lookup
+    });
+    const writeVersion = config.writeVersion;
+    return Object.freeze({
+      keyring,
+      writeVersion,
+      encrypt(plaintext, purpose) {
+        return writeVersion === 1 && legacy ? encryptField(plaintext, legacy) : keyring.encrypt(plaintext, purpose);
+      }
+    });
+  } catch {
+    throw new Error("Invalid KMS_ENCRYPTION_KEYRING configuration.");
+  }
+}
 
 // ../../src/core/crypto/mfaSecret.ts
 function protectMfaSecret(secret) {
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured)
+    return configured.encrypt(secret, "mfa");
   const key = resolveEncryptionKey();
   if (!key) {
     throw new Error("MFA secrets require KMS_ENCRYPTION_KEY.");
@@ -113,6 +258,14 @@ function revealMfaSecret(stored) {
   if (!stored) {
     return null;
   }
+  const configured = resolveFieldEncryptionKeyring();
+  if (configured) {
+    if (!stored.startsWith("enc:"))
+      throw new Error("MFA secrets must be encrypted.");
+    return configured.keyring.decrypt(stored, "mfa");
+  }
+  if (stored.startsWith("enc:") && !stored.startsWith("enc:v1:"))
+    throw new Error("Identified MFA secrets require KMS_ENCRYPTION_KEYRING.");
   if (!stored.startsWith("enc:v1:")) {
     if (isProductionEnv() || resolveEncryptionKey()) {
       throw new Error("MFA secrets must be encrypted.");

package/dist/entries/database/schema.js

@@ -694,10 +694,10 @@ function compileColumn(driver, column, mode) {
     parts[1] = `${parts[1]} AUTO_INCREMENT`;
   }
   if (column.isPrimary && mode === "create") {
-    if (driver === "sqlite") {
+    if (driver === "sqlite" && column.autoIncrement) {
       parts.push("PRIMARY KEY AUTOINCREMENT");
     } else {
-      parts.push("PRIMARY KEY");
+      parts.push(driver === "sqlite" && !column.isNullable ? "PRIMARY KEY NOT NULL" : "PRIMARY KEY");
     }
   } else if (!column.isNullable) {
     parts.push("NOT NULL");

package/dist/framework/public-api.d.ts

@@ -32,6 +32,8 @@ export { CACHE_TAGS } from "../core/cache/tags.ts";
 export { ConfigStore, createServiceToken, ServiceContainer, type ServiceToken, } from "../core/contracts/container.ts";
 export type { ServiceProvider } from "../core/contracts/di.ts";
 export { resolveService } from "../core/contracts/di.ts";
+export type { FieldEncryptionRotationBatch, FieldEncryptionRotationOptions, } from "../core/crypto/fieldEncryptionRotation";
+export { createFieldEncryptionRotationMigration, runFieldEncryptionRotationBatch, } from "../core/crypto/fieldEncryptionRotation";
 export type { TransactionAcquisitionMetrics, TransactionAcquisitionSnapshot, } from "../core/database/acquisitionMetrics.ts";
 export { createTransactionAcquisitionMetrics, renderTransactionAcquisitionMetrics, } from "../core/database/acquisitionMetrics.ts";
 export type { DatabaseConnection } from "../core/database/baseRepository.ts";
@@ -167,6 +169,7 @@ export type { TracingOptions, TracingRuntime } from "../core/tracing/tracingMidd
 export { acquireTracingRuntime, createTracingMiddleware, createTracingRuntime, getTracingRuntime, } from "../core/tracing/tracingMiddleware.ts";
 export type { ValidationRule, ValidationSchema } from "../core/validation/rules.ts";
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
-export { configureWebErrorView, configureWebLayoutData, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, xmlResponse, } from "../core/view/index.ts";
+export { CORE_VIEW_RENDERER_TOKEN, configureWebErrorView, configureWebLayoutData, createWebLayoutDataResolver, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, ViewRenderer, xmlResponse, } from "../core/view/index.ts";
 export type { ViewEngine } from "../core/view/viewEngine.ts";
+export type { HtmxViewResponseOptions, ViewResponseOptions } from "../core/view/viewRenderer.ts";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "../core/view/webLayoutData.ts";