@happyvertical/secrets 0.80.0 → 0.80.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/cli/claude-context.js +17 -17
  2. package/dist/cli/claude-context.js.map +1 -1
  3. package/dist/index.js +683 -703
  4. package/dist/index.js.map +1 -1
  5. package/package.json +6 -6
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sources":["../src/shared/envelope.ts","../src/shared/errors.ts","../src/adapters/database.ts","../src/shared/factory.ts","../src/index.ts"],"sourcesContent":["import * as crypto from 'node:crypto';\nimport type { EncryptedEnvelope } from './types.js';\n\n/**\n * Core envelope encryption primitives using AES-256-GCM\n *\n * This class provides the cryptographic operations for envelope encryption:\n * - Generate data encryption keys (DEKs)\n * - Wrap/unwrap DEKs with a master key\n * - Encrypt/decrypt data with DEKs\n *\n * @example\n * ```typescript\n * // Generate a new data key\n * const dataKey = EnvelopeEncryption.generateDataKey();\n *\n * // Wrap the data key with an AMK\n * const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);\n *\n * // Encrypt data with the data key\n * const encrypted = EnvelopeEncryption.encryptData('secret', dataKey);\n *\n * // Later: unwrap and decrypt\n * const unwrappedKey = EnvelopeEncryption.unwrapKey(wrapped.wrappedKey, wrapped.iv, wrapped.authTag, amk);\n * const plaintext = EnvelopeEncryption.decryptData(encrypted.ciphertext, encrypted.iv, encrypted.authTag, unwrappedKey);\n * ```\n */\nexport class EnvelopeEncryption {\n private static readonly ALGORITHM = 'aes-256-gcm' as const;\n private static readonly KEY_LENGTH = 32; // 256 bits\n private static readonly IV_LENGTH = 12; // 96 bits for GCM (recommended)\n private static readonly AUTH_TAG_LENGTH = 16; // 128 bits\n\n /**\n * Generate a new random data encryption key\n *\n * @returns A 32-byte (256-bit) random key\n */\n static generateDataKey(): Buffer {\n return crypto.randomBytes(EnvelopeEncryption.KEY_LENGTH);\n }\n\n /**\n * Generate a random IV for encryption\n *\n * @returns A 12-byte (96-bit) random IV\n */\n static generateIV(): Buffer {\n return crypto.randomBytes(EnvelopeEncryption.IV_LENGTH);\n }\n\n /**\n * Wrap (encrypt) a data encryption key with a master key\n *\n * @param dataKey - The data key to wrap (32 bytes)\n * @param masterKey - The master key to wrap with (32 bytes)\n * @returns Object containing wrapped key, IV, and auth tag (all base64-encoded)\n */\n static wrapKey(\n dataKey: Buffer,\n masterKey: Buffer,\n ): { wrappedKey: string; iv: string; authTag: string } {\n EnvelopeEncryption.validateKeyLength(dataKey);\n EnvelopeEncryption.validateKeyLength(masterKey);\n const iv = EnvelopeEncryption.generateIV();\n const cipher = crypto.createCipheriv(\n EnvelopeEncryption.ALGORITHM,\n masterKey,\n iv,\n );\n\n const encrypted = Buffer.concat([cipher.update(dataKey), cipher.final()]);\n const authTag = cipher.getAuthTag();\n\n return {\n wrappedKey: encrypted.toString('base64'),\n iv: iv.toString('base64'),\n authTag: authTag.toString('base64'),\n };\n }\n\n /**\n * Unwrap (decrypt) a data encryption key with a master key\n *\n * @param wrappedKey - Base64-encoded wrapped key\n * @param iv - Base64-encoded IV\n * @param authTag - Base64-encoded authentication tag\n * @param masterKey - The master key to unwrap with (32 bytes)\n * @returns The unwrapped data key (32 bytes)\n * @throws Error if decryption fails (invalid key, tampered data, etc.)\n */\n static unwrapKey(\n wrappedKey: string,\n iv: string,\n authTag: string,\n masterKey: Buffer,\n ): Buffer {\n EnvelopeEncryption.validateKeyLength(masterKey);\n const decipher = crypto.createDecipheriv(\n EnvelopeEncryption.ALGORITHM,\n masterKey,\n Buffer.from(iv, 'base64'),\n );\n decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n return Buffer.concat([\n decipher.update(Buffer.from(wrappedKey, 'base64')),\n decipher.final(),\n ]);\n }\n\n /**\n * Encrypt data with a data encryption key\n *\n * @param plaintext - The plaintext string to encrypt\n * @param dataKey - The data encryption key (32 bytes)\n * @returns Object containing ciphertext, IV, and auth tag (all base64-encoded)\n */\n static encryptData(\n plaintext: string,\n dataKey: Buffer,\n ): { ciphertext: string; iv: string; authTag: string } {\n EnvelopeEncryption.validateKeyLength(dataKey);\n const iv = EnvelopeEncryption.generateIV();\n const cipher = crypto.createCipheriv(\n EnvelopeEncryption.ALGORITHM,\n dataKey,\n iv,\n );\n\n const encrypted = Buffer.concat([\n cipher.update(plaintext, 'utf8'),\n cipher.final(),\n ]);\n const authTag = cipher.getAuthTag();\n\n return {\n ciphertext: encrypted.toString('base64'),\n iv: iv.toString('base64'),\n authTag: authTag.toString('base64'),\n };\n }\n\n /**\n * Decrypt data with a data encryption key\n *\n * @param ciphertext - Base64-encoded ciphertext\n * @param iv - Base64-encoded IV\n * @param authTag - Base64-encoded authentication tag\n * @param dataKey - The data encryption key (32 bytes)\n * @returns The decrypted plaintext string\n * @throws Error if decryption fails (invalid key, tampered data, etc.)\n */\n static decryptData(\n ciphertext: string,\n iv: string,\n authTag: string,\n dataKey: Buffer,\n ): string {\n EnvelopeEncryption.validateKeyLength(dataKey);\n const decipher = crypto.createDecipheriv(\n EnvelopeEncryption.ALGORITHM,\n dataKey,\n Buffer.from(iv, 'base64'),\n );\n decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n return Buffer.concat([\n decipher.update(Buffer.from(ciphertext, 'base64')),\n decipher.final(),\n ]).toString('utf8');\n }\n\n /**\n * Create a full encrypted envelope\n *\n * This combines key wrapping and data encryption into a single envelope\n * that can be stored and later decrypted.\n *\n * @param plaintext - The plaintext string to encrypt\n * @param dataKey - The data encryption key (32 bytes)\n * @param wrappedKeyInfo - The wrapped key info (from wrapKey)\n * @param amkKeyId - The ID of the AMK used to wrap the key\n * @param metadata - Optional metadata to include in the envelope\n * @returns A complete encrypted envelope\n */\n static createEnvelope(\n plaintext: string,\n dataKey: Buffer,\n wrappedKeyInfo: { wrappedKey: string; iv: string; authTag: string },\n amkKeyId: string,\n metadata?: Record<string, string>,\n ): EncryptedEnvelope {\n const encrypted = EnvelopeEncryption.encryptData(plaintext, dataKey);\n\n // Combine wrapped key info into a single string: wrappedKey:iv:authTag\n const combinedWrappedKey = `${wrappedKeyInfo.wrappedKey}:${wrappedKeyInfo.iv}:${wrappedKeyInfo.authTag}`;\n\n return {\n version: 1,\n algorithm: 'aes-256-gcm',\n wrappedKey: combinedWrappedKey,\n amkKeyId,\n iv: encrypted.iv,\n authTag: encrypted.authTag,\n ciphertext: encrypted.ciphertext,\n createdAt: new Date().toISOString(),\n metadata,\n };\n }\n\n /**\n * Parse a combined wrapped key string\n *\n * @param combinedWrappedKey - The combined wrapped key string (wrappedKey:iv:authTag)\n * @returns Object with wrappedKey, iv, and authTag\n */\n static parseWrappedKey(combinedWrappedKey: string): {\n wrappedKey: string;\n iv: string;\n authTag: string;\n } {\n const parts = combinedWrappedKey.split(':');\n if (parts.length !== 3) {\n throw new Error(\n 'Invalid wrapped key format: expected wrappedKey:iv:authTag',\n );\n }\n const [wrappedKey, iv, authTag] = parts;\n // Validate that all parts are non-empty\n if (!wrappedKey || !iv || !authTag) {\n throw new Error(\n 'Invalid wrapped key format: wrappedKey, iv, and authTag must all be non-empty',\n );\n }\n return { wrappedKey, iv, authTag };\n }\n\n /**\n * Decrypt a full envelope\n *\n * @param envelope - The encrypted envelope\n * @param masterKey - The master key to unwrap the data key\n * @returns The decrypted plaintext string\n */\n static decryptEnvelope(\n envelope: EncryptedEnvelope,\n masterKey: Buffer,\n ): string {\n // Parse the wrapped key\n const {\n wrappedKey,\n iv: keyIv,\n authTag: keyAuthTag,\n } = EnvelopeEncryption.parseWrappedKey(envelope.wrappedKey);\n\n // Unwrap the data key\n const dataKey = EnvelopeEncryption.unwrapKey(\n wrappedKey,\n keyIv,\n keyAuthTag,\n masterKey,\n );\n\n // Decrypt the data\n return EnvelopeEncryption.decryptData(\n envelope.ciphertext,\n envelope.iv,\n envelope.authTag,\n dataKey,\n );\n }\n\n /**\n * Validate that a key is the correct length\n *\n * @param key - The key to validate\n * @param expectedLength - Expected length in bytes (default: 32)\n * @throws Error if key length is invalid\n */\n static validateKeyLength(\n key: Buffer,\n expectedLength: number = EnvelopeEncryption.KEY_LENGTH,\n ): void {\n if (key.length !== expectedLength) {\n throw new Error(\n `Invalid key length: expected ${expectedLength} bytes, got ${key.length} bytes`,\n );\n }\n }\n\n /**\n * Parse a hex-encoded key from string\n *\n * @param hexKey - Hex-encoded key string (64 chars for 32 bytes)\n * @returns The key as a Buffer\n * @throws Error if the hex string is invalid\n */\n static parseHexKey(hexKey: string): Buffer {\n if (!/^[0-9a-fA-F]+$/.test(hexKey)) {\n throw new Error('Invalid hex key: contains non-hex characters');\n }\n\n const key = Buffer.from(hexKey, 'hex');\n EnvelopeEncryption.validateKeyLength(key);\n\n return key;\n }\n}\n","/**\n * Base error class for secret operations\n */\nexport class SecretError extends Error {\n readonly code: string;\n readonly adapterType?: string;\n readonly cause?: Error;\n\n constructor(\n message: string,\n code: string,\n options?: { adapterType?: string; cause?: Error },\n ) {\n super(message);\n this.name = 'SecretError';\n this.code = code;\n this.adapterType = options?.adapterType;\n this.cause = options?.cause;\n }\n}\n\n/**\n * Error thrown when a key is not found\n */\nexport class KeyNotFoundError extends SecretError {\n constructor(keyId: string, adapterType?: string) {\n super(`Key not found: ${keyId}`, 'KEY_NOT_FOUND', { adapterType });\n this.name = 'KeyNotFoundError';\n }\n}\n\n/**\n * Error thrown when decryption fails\n */\nexport class DecryptionError extends SecretError {\n constructor(message: string, adapterType?: string, cause?: Error) {\n super(message, 'DECRYPTION_FAILED', { adapterType, cause });\n this.name = 'DecryptionError';\n }\n}\n\n/**\n * Error thrown when encryption fails\n */\nexport class EncryptionError extends SecretError {\n constructor(message: string, adapterType?: string, cause?: Error) {\n super(message, 'ENCRYPTION_FAILED', { adapterType, cause });\n this.name = 'EncryptionError';\n }\n}\n\n/**\n * Error thrown when key rotation fails\n */\nexport class KeyRotationError extends SecretError {\n constructor(message: string, adapterType?: string, cause?: Error) {\n super(message, 'KEY_ROTATION_FAILED', { adapterType, cause });\n this.name = 'KeyRotationError';\n }\n}\n\n/**\n * Error thrown when a tenant's encryption key is missing\n */\nexport class TenantKeyMissingError extends SecretError {\n constructor(tenantId: string) {\n super(\n `No active encryption key for tenant: ${tenantId}`,\n 'TENANT_KEY_MISSING',\n );\n this.name = 'TenantKeyMissingError';\n }\n}\n\n/**\n * Error thrown when the Application Master Key is unavailable\n */\nexport class AMKUnavailableError extends SecretError {\n constructor(message: string) {\n super(message, 'AMK_UNAVAILABLE');\n this.name = 'AMKUnavailableError';\n }\n}\n\n/**\n * Error thrown when the store is not initialized\n */\nexport class StoreNotInitializedError extends SecretError {\n constructor(adapterType?: string) {\n super('Secret store not initialized', 'STORE_NOT_INITIALIZED', {\n adapterType,\n });\n this.name = 'StoreNotInitializedError';\n }\n}\n\n/**\n * Error thrown when an invalid key format is encountered\n */\nexport class InvalidKeyFormatError extends SecretError {\n constructor(message: string, adapterType?: string) {\n super(message, 'INVALID_KEY_FORMAT', { adapterType });\n this.name = 'InvalidKeyFormatError';\n }\n}\n","import { type DatabaseInterface, syncSchema } from '@happyvertical/sql';\nimport { createId } from '@happyvertical/utils';\nimport { EnvelopeEncryption } from '../shared/envelope.js';\nimport {\n AMKUnavailableError,\n DecryptionError,\n EncryptionError,\n KeyRotationError,\n StoreNotInitializedError,\n TenantKeyMissingError,\n} from '../shared/errors.js';\nimport type {\n ApplicationMasterKey,\n DatabaseSecretStoreOptions,\n DecryptedSecret,\n EncryptedEnvelope,\n EncryptOptions,\n SecretStore,\n SecretStoreEvent,\n SecretStoreEventListener,\n TenantDataEncryptionKey,\n Unsubscribe,\n} from '../shared/types.js';\n\n/**\n * Default rotation period in milliseconds (90 days)\n */\nconst DEFAULT_ROTATION_PERIOD_MS = 90 * 24 * 60 * 60 * 1000;\n\n/**\n * Database-backed secret store\n *\n * Uses envelope encryption with AES-256-GCM:\n * - Application Master Key (AMK) from environment variable\n * - Per-tenant Data Encryption Keys (TDEKs) wrapped by AMK\n * - Secrets encrypted by unwrapped TDEKs\n *\n * @example\n * ```typescript\n * const store = new DatabaseSecretStore({\n * type: 'database',\n * db,\n * amk: {\n * provider: 'env',\n * keyEnvVar: 'SECRET_MASTER_KEY',\n * keyId: 'amk-v1'\n * }\n * });\n *\n * await store.initialize();\n *\n * // Encrypt a secret for a tenant\n * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');\n *\n * // Decrypt\n * const { value } = await store.decrypt('tenant-123', envelope);\n * ```\n */\nexport class DatabaseSecretStore implements SecretStore {\n private db: DatabaseInterface;\n private keysTable: string;\n private amkConfig: DatabaseSecretStoreOptions['amk'];\n private cachedAmk: Buffer | null = null;\n private initialized = false;\n private listeners: SecretStoreEventListener[] = [];\n\n constructor(options: DatabaseSecretStoreOptions) {\n this.db = options.db;\n\n // Validate table name to prevent SQL injection via identifier interpolation\n const tableName = options.keysTable ?? 'tenant_encryption_keys';\n if (!/^[A-Za-z0-9_]+$/.test(tableName)) {\n throw new Error(\n `Invalid keysTable name \"${tableName}\". Table name must contain only alphanumeric characters and underscores.`,\n );\n }\n this.keysTable = tableName;\n\n this.amkConfig = options.amk;\n }\n\n /**\n * Initialize the store (create schema if needed)\n */\n async initialize(): Promise<void> {\n if (this.initialized) return;\n\n // Create the tenant keys table\n const schema = `\n CREATE TABLE IF NOT EXISTS \"${this.keysTable}\" (\n id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n wrapped_key TEXT NOT NULL,\n amk_key_id TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'active',\n version INTEGER NOT NULL DEFAULT 1,\n rotate_after TEXT,\n retired_at TEXT,\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL\n );\n\n CREATE INDEX IF NOT EXISTS \"idx_${this.keysTable}_tenant_status\"\n ON \"${this.keysTable}\" (tenant_id, status);\n\n CREATE INDEX IF NOT EXISTS \"idx_${this.keysTable}_rotate_after\"\n ON \"${this.keysTable}\" (rotate_after)\n WHERE status = 'active';\n `;\n\n await syncSchema({ db: this.db, schema });\n\n this.initialized = true;\n }\n\n /**\n * Get the Application Master Key from environment\n */\n private getAMK(): Buffer {\n if (this.cachedAmk) {\n return this.cachedAmk;\n }\n\n const keyHex = process.env[this.amkConfig.keyEnvVar];\n if (!keyHex) {\n throw new AMKUnavailableError(\n `Application Master Key not found in environment variable: ${this.amkConfig.keyEnvVar}`,\n );\n }\n\n try {\n const key = EnvelopeEncryption.parseHexKey(keyHex);\n this.cachedAmk = key;\n return key;\n } catch (error) {\n throw new AMKUnavailableError(\n `Invalid AMK in ${this.amkConfig.keyEnvVar}: ${(error as Error).message}`,\n );\n }\n }\n\n /**\n * Ensure the store is initialized\n */\n private ensureInitialized(): void {\n if (!this.initialized) {\n throw new StoreNotInitializedError('database');\n }\n }\n\n /**\n * Emit an event to all listeners\n */\n private async emitEvent(event: SecretStoreEvent): Promise<void> {\n for (const listener of this.listeners) {\n await listener(event);\n }\n }\n\n /**\n * Subscribe to store events\n */\n subscribe(listener: SecretStoreEventListener): Unsubscribe {\n this.listeners.push(listener);\n return () => {\n const index = this.listeners.indexOf(listener);\n if (index !== -1) {\n this.listeners.splice(index, 1);\n }\n };\n }\n\n async encrypt(\n tenantId: string,\n secretName: string,\n plaintext: string,\n options?: EncryptOptions,\n ): Promise<EncryptedEnvelope> {\n this.ensureInitialized();\n\n // Input validation\n if (typeof tenantId !== 'string' || tenantId.trim().length === 0) {\n throw new EncryptionError(\n 'Invalid tenantId provided for encryption',\n 'database',\n );\n }\n if (typeof secretName !== 'string' || secretName.trim().length === 0) {\n throw new EncryptionError(\n 'Invalid secretName provided for encryption',\n 'database',\n );\n }\n\n let dataKey: Buffer | null = null;\n try {\n // Get or create tenant's data encryption key\n let tenantKey = await this.getTenantKey(tenantId);\n if (!tenantKey) {\n tenantKey = await this.createTenantKey(tenantId);\n }\n\n // Get AMK and unwrap the TDEK\n const amk = this.getAMK();\n const {\n wrappedKey,\n iv: keyIv,\n authTag: keyAuthTag,\n } = EnvelopeEncryption.parseWrappedKey(tenantKey.wrappedKey);\n dataKey = EnvelopeEncryption.unwrapKey(\n wrappedKey,\n keyIv,\n keyAuthTag,\n amk,\n );\n\n // Create the envelope using the unwrapped TDEK\n const envelope = EnvelopeEncryption.createEnvelope(\n plaintext,\n dataKey,\n { wrappedKey, iv: keyIv, authTag: keyAuthTag },\n tenantKey.amkKeyId,\n options?.metadata,\n );\n\n // Emit event\n await this.emitEvent({\n type: 'secret.encrypted',\n tenantId,\n keyId: tenantKey.keyId,\n secretName,\n timestamp: new Date(),\n });\n\n return envelope;\n } catch (error) {\n if (\n error instanceof AMKUnavailableError ||\n error instanceof TenantKeyMissingError\n ) {\n throw error;\n }\n throw new EncryptionError(\n `Failed to encrypt secret '${secretName}' for tenant ${tenantId}: ${(error as Error).message}`,\n 'database',\n error instanceof Error ? error : undefined,\n );\n } finally {\n // Zero out the data key buffer to prevent key material from remaining in memory\n if (dataKey && Buffer.isBuffer(dataKey)) {\n dataKey.fill(0);\n }\n }\n }\n\n async decrypt(\n tenantId: string,\n envelope: EncryptedEnvelope,\n ): Promise<DecryptedSecret> {\n this.ensureInitialized();\n\n // Input validation\n if (typeof tenantId !== 'string' || tenantId.trim().length === 0) {\n throw new DecryptionError(\n 'Invalid tenantId provided for decryption',\n 'database',\n );\n }\n\n // Get all key versions for this tenant (including retired keys for decryption)\n const tenantKeys = await this.listKeyVersions(tenantId);\n if (tenantKeys.length === 0) {\n throw new TenantKeyMissingError(tenantId);\n }\n\n // Verify that the envelope's wrapped key belongs to this tenant\n // Extract the wrapped key portion from the envelope (format: wrappedKey:iv:authTag)\n const envelopeWrappedKeyParts = envelope.wrappedKey.split(':');\n const envelopeWrappedKey = envelopeWrappedKeyParts[0];\n\n const matchingKey = tenantKeys.find((key) => {\n const keyParts = key.wrappedKey.split(':');\n return keyParts[0] === envelopeWrappedKey;\n });\n\n if (!matchingKey) {\n throw new DecryptionError(\n `Envelope was not encrypted with a key belonging to tenant ${tenantId}`,\n 'database',\n );\n }\n\n try {\n // Get AMK and decrypt the envelope\n const amk = this.getAMK();\n const plaintext = EnvelopeEncryption.decryptEnvelope(envelope, amk);\n\n // Emit event\n await this.emitEvent({\n type: 'secret.decrypted',\n tenantId,\n keyId: matchingKey.keyId,\n timestamp: new Date(),\n });\n\n return {\n value: plaintext,\n keyId: matchingKey.keyId,\n createdAt: new Date(envelope.createdAt),\n metadata: envelope.metadata,\n };\n } catch (error) {\n if (error instanceof AMKUnavailableError) {\n throw error;\n }\n throw new DecryptionError(\n `Failed to decrypt secret for tenant ${tenantId}: ${(error as Error).message}`,\n 'database',\n error instanceof Error ? error : undefined,\n );\n }\n }\n\n async getTenantKey(\n tenantId: string,\n ): Promise<TenantDataEncryptionKey | null> {\n this.ensureInitialized();\n\n const row = await this.db.get(this.keysTable, {\n tenant_id: tenantId,\n status: 'active',\n });\n\n if (!row) return null;\n\n return this.parseKeyRow(row as Record<string, unknown>);\n }\n\n async createTenantKey(tenantId: string): Promise<TenantDataEncryptionKey> {\n this.ensureInitialized();\n\n // Generate and wrap a new data key\n const amk = this.getAMK();\n const dataKey = EnvelopeEncryption.generateDataKey();\n const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);\n\n const keyId = createId();\n const wrappedKeyStr = `${wrapped.wrappedKey}:${wrapped.iv}:${wrapped.authTag}`;\n const now = new Date();\n const rotateAfter = new Date(now.getTime() + DEFAULT_ROTATION_PERIOD_MS);\n\n await this.db.insert(this.keysTable, {\n id: keyId,\n tenant_id: tenantId,\n wrapped_key: wrappedKeyStr,\n amk_key_id: this.amkConfig.keyId,\n status: 'active',\n version: 1,\n rotate_after: rotateAfter.toISOString(),\n created_at: now.toISOString(),\n updated_at: now.toISOString(),\n });\n\n // Emit event\n await this.emitEvent({\n type: 'key.created',\n tenantId,\n keyId,\n timestamp: now,\n });\n\n return {\n keyId,\n tenantId,\n wrappedKey: wrappedKeyStr,\n amkKeyId: this.amkConfig.keyId,\n status: 'active',\n version: 1,\n createdAt: now,\n rotateAfter,\n };\n }\n\n async rotateTenantKey(tenantId: string): Promise<TenantDataEncryptionKey> {\n this.ensureInitialized();\n\n const currentKey = await this.getTenantKey(tenantId);\n if (!currentKey) {\n throw new TenantKeyMissingError(tenantId);\n }\n\n const now = new Date();\n\n try {\n // Mark current key as rotating\n await this.db.update(\n this.keysTable,\n { id: currentKey.keyId },\n { status: 'rotating', updated_at: now.toISOString() },\n );\n\n // Create new key with incremented version\n const amk = this.getAMK();\n const dataKey = EnvelopeEncryption.generateDataKey();\n const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);\n\n const newKeyId = createId();\n const wrappedKeyStr = `${wrapped.wrappedKey}:${wrapped.iv}:${wrapped.authTag}`;\n const rotateAfter = new Date(now.getTime() + DEFAULT_ROTATION_PERIOD_MS);\n\n await this.db.insert(this.keysTable, {\n id: newKeyId,\n tenant_id: tenantId,\n wrapped_key: wrappedKeyStr,\n amk_key_id: this.amkConfig.keyId,\n status: 'active',\n version: currentKey.version + 1,\n rotate_after: rotateAfter.toISOString(),\n created_at: now.toISOString(),\n updated_at: now.toISOString(),\n });\n\n // Mark old key as retired\n await this.db.update(\n this.keysTable,\n { id: currentKey.keyId },\n {\n status: 'retired',\n retired_at: now.toISOString(),\n updated_at: now.toISOString(),\n },\n );\n\n // Emit event\n await this.emitEvent({\n type: 'key.rotated',\n tenantId,\n keyId: newKeyId,\n timestamp: now,\n });\n\n return {\n keyId: newKeyId,\n tenantId,\n wrappedKey: wrappedKeyStr,\n amkKeyId: this.amkConfig.keyId,\n status: 'active',\n version: currentKey.version + 1,\n createdAt: now,\n rotateAfter,\n };\n } catch (error) {\n throw new KeyRotationError(\n `Failed to rotate key for tenant ${tenantId}: ${(error as Error).message}`,\n 'database',\n error instanceof Error ? error : undefined,\n );\n }\n }\n\n async retireTenantKey(tenantId: string, keyId: string): Promise<void> {\n this.ensureInitialized();\n\n const now = new Date();\n\n await this.db.update(\n this.keysTable,\n { id: keyId, tenant_id: tenantId },\n {\n status: 'retired',\n retired_at: now.toISOString(),\n updated_at: now.toISOString(),\n },\n );\n\n // Emit event\n await this.emitEvent({\n type: 'key.retired',\n tenantId,\n keyId,\n timestamp: now,\n });\n }\n\n async getActiveAMK(): Promise<ApplicationMasterKey> {\n // Validate that the AMK is accessible\n this.getAMK();\n\n return {\n keyId: this.amkConfig.keyId,\n description: `AMK from env var ${this.amkConfig.keyEnvVar}`,\n status: 'active',\n provider: 'env',\n keyReference: this.amkConfig.keyEnvVar,\n createdAt: new Date(),\n };\n }\n\n async rewrapTenantKey(\n _tenantId: string,\n _newAmkKeyId: string,\n ): Promise<TenantDataEncryptionKey> {\n // For env-based AMK, this would require:\n // 1. Having both old and new AMK available\n // 2. Unwrapping with old AMK\n // 3. Rewrapping with new AMK\n // This is complex and risky for env-based keys\n throw new Error(\n 'AMK rotation not supported for env-based keys. ' +\n 'Use AWS KMS, Vault, or Azure Key Vault for AMK rotation support.',\n );\n }\n\n async listKeyVersions(tenantId: string): Promise<TenantDataEncryptionKey[]> {\n this.ensureInitialized();\n\n const { rows } = await this.db.query(\n `SELECT * FROM \"${this.keysTable}\" WHERE tenant_id = ? ORDER BY version DESC`,\n tenantId,\n );\n\n return rows.map((row: Record<string, unknown>) => this.parseKeyRow(row));\n }\n\n /**\n * Parse a database row into a TenantDataEncryptionKey\n */\n private parseKeyRow(row: Record<string, unknown>): TenantDataEncryptionKey {\n return {\n keyId: row.id as string,\n tenantId: row.tenant_id as string,\n wrappedKey: row.wrapped_key as string,\n amkKeyId: row.amk_key_id as string,\n status: row.status as TenantDataEncryptionKey['status'],\n version: row.version as number,\n createdAt: new Date(row.created_at as string),\n rotateAfter: row.rotate_after\n ? new Date(row.rotate_after as string)\n : undefined,\n retiredAt: row.retired_at\n ? new Date(row.retired_at as string)\n : undefined,\n };\n }\n}\n\nexport default DatabaseSecretStore;\n","import type {\n AWSKMSSecretStoreOptions,\n AzureKeyVaultSecretStoreOptions,\n DatabaseSecretStoreOptions,\n GetSecretStoreOptions,\n SecretStore,\n VaultSecretStoreOptions,\n} from './types.js';\n\n/**\n * Type guard for database options\n */\nexport function isDatabaseOptions(\n opts: GetSecretStoreOptions,\n): opts is DatabaseSecretStoreOptions {\n return opts.type === 'database';\n}\n\n/**\n * Type guard for AWS KMS options\n */\nexport function isAWSKMSOptions(\n opts: GetSecretStoreOptions,\n): opts is AWSKMSSecretStoreOptions {\n return opts.type === 'aws-kms';\n}\n\n/**\n * Type guard for Vault options\n */\nexport function isVaultOptions(\n opts: GetSecretStoreOptions,\n): opts is VaultSecretStoreOptions {\n return opts.type === 'vault';\n}\n\n/**\n * Type guard for Azure Key Vault options\n */\nexport function isAzureKeyVaultOptions(\n opts: GetSecretStoreOptions,\n): opts is AzureKeyVaultSecretStoreOptions {\n return opts.type === 'azure-keyvault';\n}\n\n/**\n * Factory function to create secret store instances\n *\n * Uses lazy imports to avoid loading unnecessary adapters and their dependencies.\n *\n * @example\n * ```typescript\n * // Database-backed store with env-based AMK\n * const store = await getSecretStore({\n * type: 'database',\n * db,\n * amk: {\n * provider: 'env',\n * keyEnvVar: 'SECRET_MASTER_KEY',\n * keyId: 'amk-v1'\n * }\n * });\n *\n * // Encrypt a secret\n * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');\n *\n * // Decrypt\n * const decrypted = await store.decrypt('tenant-123', envelope);\n * ```\n */\nexport async function getSecretStore(\n options: GetSecretStoreOptions,\n): Promise<SecretStore> {\n if (isDatabaseOptions(options)) {\n const { DatabaseSecretStore } = await import('../adapters/database.js');\n const store = new DatabaseSecretStore(options);\n await store.initialize();\n return store;\n }\n\n if (isAWSKMSOptions(options)) {\n // Phase 2: AWS KMS adapter\n throw new Error(\n 'AWS KMS adapter not yet implemented. Coming in a future release.',\n );\n }\n\n if (isVaultOptions(options)) {\n // Phase 2: HashiCorp Vault adapter\n throw new Error(\n 'HashiCorp Vault adapter not yet implemented. Coming in a future release.',\n );\n }\n\n if (isAzureKeyVaultOptions(options)) {\n // Phase 2: Azure Key Vault adapter\n throw new Error(\n 'Azure Key Vault adapter not yet implemented. Coming in a future release.',\n );\n }\n\n throw new Error(\n `Unsupported secret store type: ${(options as { type: string }).type}`,\n );\n}\n","/**\n * @happyvertical/secrets\n *\n * Envelope encryption for per-tenant secret management with pluggable backends.\n *\n * @example\n * ```typescript\n * import { getSecretStore } from '@happyvertical/secrets';\n * import { getDatabase } from '@happyvertical/sql';\n *\n * // Get a database connection\n * const db = await getDatabase({ type: 'sqlite', url: ':memory:' });\n *\n * // Create a secret store\n * const store = await getSecretStore({\n * type: 'database',\n * db,\n * amk: {\n * provider: 'env',\n * keyEnvVar: 'SECRET_MASTER_KEY', // 64 hex chars (32 bytes)\n * keyId: 'amk-v1'\n * }\n * });\n *\n * // Encrypt a secret for a tenant\n * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');\n *\n * // Decrypt the secret\n * const { value } = await store.decrypt('tenant-123', envelope);\n * console.log(value); // 'sk_live_xxx'\n *\n * // Rotate tenant's encryption key\n * await store.rotateTenantKey('tenant-123');\n * ```\n *\n * @packageDocumentation\n */\n\n// Direct adapter exports (for advanced usage)\nexport { DatabaseSecretStore } from './adapters/database.js';\n// Envelope encryption primitives\nexport { EnvelopeEncryption } from './shared/envelope.js';\n// Error classes\nexport {\n AMKUnavailableError,\n DecryptionError,\n EncryptionError,\n InvalidKeyFormatError,\n KeyNotFoundError,\n KeyRotationError,\n SecretError,\n StoreNotInitializedError,\n TenantKeyMissingError,\n} from './shared/errors.js';\n\n// Factory function\nexport {\n getSecretStore,\n isAWSKMSOptions,\n isAzureKeyVaultOptions,\n isDatabaseOptions,\n isVaultOptions,\n} from './shared/factory.js';\n// Core types\nexport type {\n // Adapter options\n AMKConfig,\n ApplicationMasterKey,\n AWSKMSSecretStoreOptions,\n AzureKeyVaultSecretStoreOptions,\n DatabaseSecretStoreOptions,\n DecryptedSecret,\n EncryptedEnvelope,\n EncryptOptions,\n GetSecretStoreOptions,\n SecretAdapterType,\n SecretStore,\n SecretStoreEvent,\n SecretStoreEventListener,\n SecretStoreEventType,\n TenantDataEncryptionKey,\n Unsubscribe,\n VaultSecretStoreOptions,\n} from './shared/types.js';\n\n/** @internal */\nexport const PACKAGE_VERSION_INITIALIZED = true;\n"],"names":["DatabaseSecretStore"],"mappings":";;;AA2BO,MAAM,mBAAmB;AAAA,EAC9B,OAAwB,YAAY;AAAA,EACpC,OAAwB,aAAa;AAAA;AAAA,EACrC,OAAwB,YAAY;AAAA;AAAA,EACpC,OAAwB,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1C,OAAO,kBAA0B;AAC/B,WAAO,OAAO,YAAY,mBAAmB,UAAU;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,aAAqB;AAC1B,WAAO,OAAO,YAAY,mBAAmB,SAAS;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,QACL,SACA,WACqD;AACrD,uBAAmB,kBAAkB,OAAO;AAC5C,uBAAmB,kBAAkB,SAAS;AAC9C,UAAM,KAAK,mBAAmB,WAAA;AAC9B,UAAM,SAAS,OAAO;AAAA,MACpB,mBAAmB;AAAA,MACnB;AAAA,MACA;AAAA,IAAA;AAGF,UAAM,YAAY,OAAO,OAAO,CAAC,OAAO,OAAO,OAAO,GAAG,OAAO,MAAA,CAAO,CAAC;AACxE,UAAM,UAAU,OAAO,WAAA;AAEvB,WAAO;AAAA,MACL,YAAY,UAAU,SAAS,QAAQ;AAAA,MACvC,IAAI,GAAG,SAAS,QAAQ;AAAA,MACxB,SAAS,QAAQ,SAAS,QAAQ;AAAA,IAAA;AAAA,EAEtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAO,UACL,YACA,IACA,SACA,WACQ;AACR,uBAAmB,kBAAkB,SAAS;AAC9C,UAAM,WAAW,OAAO;AAAA,MACtB,mBAAmB;AAAA,MACnB;AAAA,MACA,OAAO,KAAK,IAAI,QAAQ;AAAA,IAAA;AAE1B,aAAS,WAAW,OAAO,KAAK,SAAS,QAAQ,CAAC;AAElD,WAAO,OAAO,OAAO;AAAA,MACnB,SAAS,OAAO,OAAO,KAAK,YAAY,QAAQ,CAAC;AAAA,MACjD,SAAS,MAAA;AAAA,IAAM,CAChB;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,YACL,WACA,SACqD;AACrD,uBAAmB,kBAAkB,OAAO;AAC5C,UAAM,KAAK,mBAAmB,WAAA;AAC9B,UAAM,SAAS,OAAO;AAAA,MACpB,mBAAmB;AAAA,MACnB;AAAA,MACA;AAAA,IAAA;AAGF,UAAM,YAAY,OAAO,OAAO;AAAA,MAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,MAC/B,OAAO,MAAA;AAAA,IAAM,CACd;AACD,UAAM,UAAU,OAAO,WAAA;AAEvB,WAAO;AAAA,MACL,YAAY,UAAU,SAAS,QAAQ;AAAA,MACvC,IAAI,GAAG,SAAS,QAAQ;AAAA,MACxB,SAAS,QAAQ,SAAS,QAAQ;AAAA,IAAA;AAAA,EAEtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAO,YACL,YACA,IACA,SACA,SACQ;AACR,uBAAmB,kBAAkB,OAAO;AAC5C,UAAM,WAAW,OAAO;AAAA,MACtB,mBAAmB;AAAA,MACnB;AAAA,MACA,OAAO,KAAK,IAAI,QAAQ;AAAA,IAAA;AAE1B,aAAS,WAAW,OAAO,KAAK,SAAS,QAAQ,CAAC;AAElD,WAAO,OAAO,OAAO;AAAA,MACnB,SAAS,OAAO,OAAO,KAAK,YAAY,QAAQ,CAAC;AAAA,MACjD,SAAS,MAAA;AAAA,IAAM,CAChB,EAAE,SAAS,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,OAAO,eACL,WACA,SACA,gBACA,UACA,UACmB;AACnB,UAAM,YAAY,mBAAmB,YAAY,WAAW,OAAO;AAGnE,UAAM,qBAAqB,GAAG,eAAe,UAAU,IAAI,eAAe,EAAE,IAAI,eAAe,OAAO;AAEtG,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,MACX,YAAY;AAAA,MACZ;AAAA,MACA,IAAI,UAAU;AAAA,MACd,SAAS,UAAU;AAAA,MACnB,YAAY,UAAU;AAAA,MACtB,YAAW,oBAAI,KAAA,GAAO,YAAA;AAAA,MACtB;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,gBAAgB,oBAIrB;AACA,UAAM,QAAQ,mBAAmB,MAAM,GAAG;AAC1C,QAAI,MAAM,WAAW,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AACA,UAAM,CAAC,YAAY,IAAI,OAAO,IAAI;AAElC,QAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AACA,WAAO,EAAE,YAAY,IAAI,QAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,gBACL,UACA,WACQ;AAER,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,SAAS;AAAA,IAAA,IACP,mBAAmB,gBAAgB,SAAS,UAAU;AAG1D,UAAM,UAAU,mBAAmB;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAIF,WAAO,mBAAmB;AAAA,MACxB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,MACT;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,kBACL,KACA,iBAAyB,mBAAmB,YACtC;AACN,QAAI,IAAI,WAAW,gBAAgB;AACjC,YAAM,IAAI;AAAA,QACR,gCAAgC,cAAc,eAAe,IAAI,MAAM;AAAA,MAAA;AAAA,IAE3E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,YAAY,QAAwB;AACzC,QAAI,CAAC,iBAAiB,KAAK,MAAM,GAAG;AAClC,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,UAAM,MAAM,OAAO,KAAK,QAAQ,KAAK;AACrC,uBAAmB,kBAAkB,GAAG;AAExC,WAAO;AAAA,EACT;AACF;ACjTO,MAAM,oBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,MACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc,SAAS;AAC5B,SAAK,QAAQ,SAAS;AAAA,EACxB;AACF;AAKO,MAAM,yBAAyB,YAAY;AAAA,EAChD,YAAY,OAAe,aAAsB;AAC/C,UAAM,kBAAkB,KAAK,IAAI,iBAAiB,EAAE,aAAa;AACjE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,wBAAwB,YAAY;AAAA,EAC/C,YAAY,SAAiB,aAAsB,OAAe;AAChE,UAAM,SAAS,qBAAqB,EAAE,aAAa,OAAO;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,wBAAwB,YAAY;AAAA,EAC/C,YAAY,SAAiB,aAAsB,OAAe;AAChE,UAAM,SAAS,qBAAqB,EAAE,aAAa,OAAO;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,yBAAyB,YAAY;AAAA,EAChD,YAAY,SAAiB,aAAsB,OAAe;AAChE,UAAM,SAAS,uBAAuB,EAAE,aAAa,OAAO;AAC5D,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,8BAA8B,YAAY;AAAA,EACrD,YAAY,UAAkB;AAC5B;AAAA,MACE,wCAAwC,QAAQ;AAAA,MAChD;AAAA,IAAA;AAEF,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,4BAA4B,YAAY;AAAA,EACnD,YAAY,SAAiB;AAC3B,UAAM,SAAS,iBAAiB;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,iCAAiC,YAAY;AAAA,EACxD,YAAY,aAAsB;AAChC,UAAM,gCAAgC,yBAAyB;AAAA,MAC7D;AAAA,IAAA,CACD;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,8BAA8B,YAAY;AAAA,EACrD,YAAY,SAAiB,aAAsB;AACjD,UAAM,SAAS,sBAAsB,EAAE,YAAA,CAAa;AACpD,SAAK,OAAO;AAAA,EACd;AACF;AC7EA,MAAM,6BAA6B,KAAK,KAAK,KAAK,KAAK;AA+BhD,MAAM,oBAA2C;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAA2B;AAAA,EAC3B,cAAc;AAAA,EACd,YAAwC,CAAA;AAAA,EAEhD,YAAY,SAAqC;AAC/C,SAAK,KAAK,QAAQ;AAGlB,UAAM,YAAY,QAAQ,aAAa;AACvC,QAAI,CAAC,kBAAkB,KAAK,SAAS,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,2BAA2B,SAAS;AAAA,MAAA;AAAA,IAExC;AACA,SAAK,YAAY;AAEjB,SAAK,YAAY,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAA4B;AAChC,QAAI,KAAK,YAAa;AAGtB,UAAM,SAAS;AAAA,oCACiB,KAAK,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wCAaV,KAAK,SAAS;AAAA,cACxC,KAAK,SAAS;AAAA;AAAA,wCAEY,KAAK,SAAS;AAAA,cACxC,KAAK,SAAS;AAAA;AAAA;AAIxB,UAAM,WAAW,EAAE,IAAI,KAAK,IAAI,QAAQ;AAExC,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKQ,SAAiB;AACvB,QAAI,KAAK,WAAW;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,SAAS,QAAQ,IAAI,KAAK,UAAU,SAAS;AACnD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR,6DAA6D,KAAK,UAAU,SAAS;AAAA,MAAA;AAAA,IAEzF;AAEA,QAAI;AACF,YAAM,MAAM,mBAAmB,YAAY,MAAM;AACjD,WAAK,YAAY;AACjB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,UAAU,SAAS,KAAM,MAAgB,OAAO;AAAA,MAAA;AAAA,IAE3E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,oBAA0B;AAChC,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI,yBAAyB,UAAU;AAAA,IAC/C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,UAAU,OAAwC;AAC9D,eAAW,YAAY,KAAK,WAAW;AACrC,YAAM,SAAS,KAAK;AAAA,IACtB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,UAAiD;AACzD,SAAK,UAAU,KAAK,QAAQ;AAC5B,WAAO,MAAM;AACX,YAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;AAC7C,UAAI,UAAU,IAAI;AAChB,aAAK,UAAU,OAAO,OAAO,CAAC;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,UACA,YACA,WACA,SAC4B;AAC5B,SAAK,kBAAA;AAGL,QAAI,OAAO,aAAa,YAAY,SAAS,KAAA,EAAO,WAAW,GAAG;AAChE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AACA,QAAI,OAAO,eAAe,YAAY,WAAW,KAAA,EAAO,WAAW,GAAG;AACpE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,UAAyB;AAC7B,QAAI;AAEF,UAAI,YAAY,MAAM,KAAK,aAAa,QAAQ;AAChD,UAAI,CAAC,WAAW;AACd,oBAAY,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACjD;AAGA,YAAM,MAAM,KAAK,OAAA;AACjB,YAAM;AAAA,QACJ;AAAA,QACA,IAAI;AAAA,QACJ,SAAS;AAAA,MAAA,IACP,mBAAmB,gBAAgB,UAAU,UAAU;AAC3D,gBAAU,mBAAmB;AAAA,QAC3B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAIF,YAAM,WAAW,mBAAmB;AAAA,QAClC;AAAA,QACA;AAAA,QACA,EAAE,YAAY,IAAI,OAAO,SAAS,WAAA;AAAA,QAClC,UAAU;AAAA,QACV,SAAS;AAAA,MAAA;AAIX,YAAM,KAAK,UAAU;AAAA,QACnB,MAAM;AAAA,QACN;AAAA,QACA,OAAO,UAAU;AAAA,QACjB;AAAA,QACA,+BAAe,KAAA;AAAA,MAAK,CACrB;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UACE,iBAAiB,uBACjB,iBAAiB,uBACjB;AACA,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR,6BAA6B,UAAU,gBAAgB,QAAQ,KAAM,MAAgB,OAAO;AAAA,QAC5F;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAErC,UAAA;AAEE,UAAI,WAAW,OAAO,SAAS,OAAO,GAAG;AACvC,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,UACA,UAC0B;AAC1B,SAAK,kBAAA;AAGL,QAAI,OAAO,aAAa,YAAY,SAAS,KAAA,EAAO,WAAW,GAAG;AAChE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAGA,UAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AACtD,QAAI,WAAW,WAAW,GAAG;AAC3B,YAAM,IAAI,sBAAsB,QAAQ;AAAA,IAC1C;AAIA,UAAM,0BAA0B,SAAS,WAAW,MAAM,GAAG;AAC7D,UAAM,qBAAqB,wBAAwB,CAAC;AAEpD,UAAM,cAAc,WAAW,KAAK,CAAC,QAAQ;AAC3C,YAAM,WAAW,IAAI,WAAW,MAAM,GAAG;AACzC,aAAO,SAAS,CAAC,MAAM;AAAA,IACzB,CAAC;AAED,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR,6DAA6D,QAAQ;AAAA,QACrE;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI;AAEF,YAAM,MAAM,KAAK,OAAA;AACjB,YAAM,YAAY,mBAAmB,gBAAgB,UAAU,GAAG;AAGlE,YAAM,KAAK,UAAU;AAAA,QACnB,MAAM;AAAA,QACN;AAAA,QACA,OAAO,YAAY;AAAA,QACnB,+BAAe,KAAA;AAAA,MAAK,CACrB;AAED,aAAO;AAAA,QACL,OAAO;AAAA,QACP,OAAO,YAAY;AAAA,QACnB,WAAW,IAAI,KAAK,SAAS,SAAS;AAAA,QACtC,UAAU,SAAS;AAAA,MAAA;AAAA,IAEvB,SAAS,OAAO;AACd,UAAI,iBAAiB,qBAAqB;AACxC,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR,uCAAuC,QAAQ,KAAM,MAAgB,OAAO;AAAA,QAC5E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAErC;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,UACyC;AACzC,SAAK,kBAAA;AAEL,UAAM,MAAM,MAAM,KAAK,GAAG,IAAI,KAAK,WAAW;AAAA,MAC5C,WAAW;AAAA,MACX,QAAQ;AAAA,IAAA,CACT;AAED,QAAI,CAAC,IAAK,QAAO;AAEjB,WAAO,KAAK,YAAY,GAA8B;AAAA,EACxD;AAAA,EAEA,MAAM,gBAAgB,UAAoD;AACxE,SAAK,kBAAA;AAGL,UAAM,MAAM,KAAK,OAAA;AACjB,UAAM,UAAU,mBAAmB,gBAAA;AACnC,UAAM,UAAU,mBAAmB,QAAQ,SAAS,GAAG;AAEvD,UAAM,QAAQ,SAAA;AACd,UAAM,gBAAgB,GAAG,QAAQ,UAAU,IAAI,QAAQ,EAAE,IAAI,QAAQ,OAAO;AAC5E,UAAM,0BAAU,KAAA;AAChB,UAAM,cAAc,IAAI,KAAK,IAAI,QAAA,IAAY,0BAA0B;AAEvE,UAAM,KAAK,GAAG,OAAO,KAAK,WAAW;AAAA,MACnC,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,aAAa;AAAA,MACb,YAAY,KAAK,UAAU;AAAA,MAC3B,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,cAAc,YAAY,YAAA;AAAA,MAC1B,YAAY,IAAI,YAAA;AAAA,MAChB,YAAY,IAAI,YAAA;AAAA,IAAY,CAC7B;AAGD,UAAM,KAAK,UAAU;AAAA,MACnB,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IAAA,CACZ;AAED,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU,KAAK,UAAU;AAAA,MACzB,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,WAAW;AAAA,MACX;AAAA,IAAA;AAAA,EAEJ;AAAA,EAEA,MAAM,gBAAgB,UAAoD;AACxE,SAAK,kBAAA;AAEL,UAAM,aAAa,MAAM,KAAK,aAAa,QAAQ;AACnD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,sBAAsB,QAAQ;AAAA,IAC1C;AAEA,UAAM,0BAAU,KAAA;AAEhB,QAAI;AAEF,YAAM,KAAK,GAAG;AAAA,QACZ,KAAK;AAAA,QACL,EAAE,IAAI,WAAW,MAAA;AAAA,QACjB,EAAE,QAAQ,YAAY,YAAY,IAAI,cAAY;AAAA,MAAE;AAItD,YAAM,MAAM,KAAK,OAAA;AACjB,YAAM,UAAU,mBAAmB,gBAAA;AACnC,YAAM,UAAU,mBAAmB,QAAQ,SAAS,GAAG;AAEvD,YAAM,WAAW,SAAA;AACjB,YAAM,gBAAgB,GAAG,QAAQ,UAAU,IAAI,QAAQ,EAAE,IAAI,QAAQ,OAAO;AAC5E,YAAM,cAAc,IAAI,KAAK,IAAI,QAAA,IAAY,0BAA0B;AAEvE,YAAM,KAAK,GAAG,OAAO,KAAK,WAAW;AAAA,QACnC,IAAI;AAAA,QACJ,WAAW;AAAA,QACX,aAAa;AAAA,QACb,YAAY,KAAK,UAAU;AAAA,QAC3B,QAAQ;AAAA,QACR,SAAS,WAAW,UAAU;AAAA,QAC9B,cAAc,YAAY,YAAA;AAAA,QAC1B,YAAY,IAAI,YAAA;AAAA,QAChB,YAAY,IAAI,YAAA;AAAA,MAAY,CAC7B;AAGD,YAAM,KAAK,GAAG;AAAA,QACZ,KAAK;AAAA,QACL,EAAE,IAAI,WAAW,MAAA;AAAA,QACjB;AAAA,UACE,QAAQ;AAAA,UACR,YAAY,IAAI,YAAA;AAAA,UAChB,YAAY,IAAI,YAAA;AAAA,QAAY;AAAA,MAC9B;AAIF,YAAM,KAAK,UAAU;AAAA,QACnB,MAAM;AAAA,QACN;AAAA,QACA,OAAO;AAAA,QACP,WAAW;AAAA,MAAA,CACZ;AAED,aAAO;AAAA,QACL,OAAO;AAAA,QACP;AAAA,QACA,YAAY;AAAA,QACZ,UAAU,KAAK,UAAU;AAAA,QACzB,QAAQ;AAAA,QACR,SAAS,WAAW,UAAU;AAAA,QAC9B,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IAEJ,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,mCAAmC,QAAQ,KAAM,MAAgB,OAAO;AAAA,QACxE;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAErC;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,UAAkB,OAA8B;AACpE,SAAK,kBAAA;AAEL,UAAM,0BAAU,KAAA;AAEhB,UAAM,KAAK,GAAG;AAAA,MACZ,KAAK;AAAA,MACL,EAAE,IAAI,OAAO,WAAW,SAAA;AAAA,MACxB;AAAA,QACE,QAAQ;AAAA,QACR,YAAY,IAAI,YAAA;AAAA,QAChB,YAAY,IAAI,YAAA;AAAA,MAAY;AAAA,IAC9B;AAIF,UAAM,KAAK,UAAU;AAAA,MACnB,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IAAA,CACZ;AAAA,EACH;AAAA,EAEA,MAAM,eAA8C;AAElD,SAAK,OAAA;AAEL,WAAO;AAAA,MACL,OAAO,KAAK,UAAU;AAAA,MACtB,aAAa,oBAAoB,KAAK,UAAU,SAAS;AAAA,MACzD,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc,KAAK,UAAU;AAAA,MAC7B,+BAAe,KAAA;AAAA,IAAK;AAAA,EAExB;AAAA,EAEA,MAAM,gBACJ,WACA,cACkC;AAMlC,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAGJ;AAAA,EAEA,MAAM,gBAAgB,UAAsD;AAC1E,SAAK,kBAAA;AAEL,UAAM,EAAE,KAAA,IAAS,MAAM,KAAK,GAAG;AAAA,MAC7B,kBAAkB,KAAK,SAAS;AAAA,MAChC;AAAA,IAAA;AAGF,WAAO,KAAK,IAAI,CAAC,QAAiC,KAAK,YAAY,GAAG,CAAC;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,KAAuD;AACzE,WAAO;AAAA,MACL,OAAO,IAAI;AAAA,MACX,UAAU,IAAI;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,UAAU,IAAI;AAAA,MACd,QAAQ,IAAI;AAAA,MACZ,SAAS,IAAI;AAAA,MACb,WAAW,IAAI,KAAK,IAAI,UAAoB;AAAA,MAC5C,aAAa,IAAI,eACb,IAAI,KAAK,IAAI,YAAsB,IACnC;AAAA,MACJ,WAAW,IAAI,aACX,IAAI,KAAK,IAAI,UAAoB,IACjC;AAAA,IAAA;AAAA,EAER;AACF;;;;;ACphBO,SAAS,kBACd,MACoC;AACpC,SAAO,KAAK,SAAS;AACvB;AAKO,SAAS,gBACd,MACkC;AAClC,SAAO,KAAK,SAAS;AACvB;AAKO,SAAS,eACd,MACiC;AACjC,SAAO,KAAK,SAAS;AACvB;AAKO,SAAS,uBACd,MACyC;AACzC,SAAO,KAAK,SAAS;AACvB;AA2BA,eAAsB,eACpB,SACsB;AACtB,MAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAM,EAAE,qBAAAA,qBAAA,IAAwB,MAAM,QAAA,QAAA,EAAA,KAAA,MAAA,QAAA;AACtC,UAAM,QAAQ,IAAIA,qBAAoB,OAAO;AAC7C,UAAM,MAAM,WAAA;AACZ,WAAO;AAAA,EACT;AAEA,MAAI,gBAAgB,OAAO,GAAG;AAE5B,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AAEA,MAAI,eAAe,OAAO,GAAG;AAE3B,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AAEA,MAAI,uBAAuB,OAAO,GAAG;AAEnC,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AAEA,QAAM,IAAI;AAAA,IACR,kCAAmC,QAA6B,IAAI;AAAA,EAAA;AAExE;AClBO,MAAM,8BAA8B;"}
1
+ {"version":3,"file":"index.js","names":[],"sources":["../src/shared/envelope.ts","../src/shared/errors.ts","../src/adapters/database.ts","../src/shared/factory.ts","../src/index.ts"],"sourcesContent":["import * as crypto from 'node:crypto';\nimport type { EncryptedEnvelope } from './types.js';\n\n/**\n * Core envelope encryption primitives using AES-256-GCM\n *\n * This class provides the cryptographic operations for envelope encryption:\n * - Generate data encryption keys (DEKs)\n * - Wrap/unwrap DEKs with a master key\n * - Encrypt/decrypt data with DEKs\n *\n * @example\n * ```typescript\n * // Generate a new data key\n * const dataKey = EnvelopeEncryption.generateDataKey();\n *\n * // Wrap the data key with an AMK\n * const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);\n *\n * // Encrypt data with the data key\n * const encrypted = EnvelopeEncryption.encryptData('secret', dataKey);\n *\n * // Later: unwrap and decrypt\n * const unwrappedKey = EnvelopeEncryption.unwrapKey(wrapped.wrappedKey, wrapped.iv, wrapped.authTag, amk);\n * const plaintext = EnvelopeEncryption.decryptData(encrypted.ciphertext, encrypted.iv, encrypted.authTag, unwrappedKey);\n * ```\n */\nexport class EnvelopeEncryption {\n private static readonly ALGORITHM = 'aes-256-gcm' as const;\n private static readonly KEY_LENGTH = 32; // 256 bits\n private static readonly IV_LENGTH = 12; // 96 bits for GCM (recommended)\n private static readonly AUTH_TAG_LENGTH = 16; // 128 bits\n\n /**\n * Generate a new random data encryption key\n *\n * @returns A 32-byte (256-bit) random key\n */\n static generateDataKey(): Buffer {\n return crypto.randomBytes(EnvelopeEncryption.KEY_LENGTH);\n }\n\n /**\n * Generate a random IV for encryption\n *\n * @returns A 12-byte (96-bit) random IV\n */\n static generateIV(): Buffer {\n return crypto.randomBytes(EnvelopeEncryption.IV_LENGTH);\n }\n\n /**\n * Wrap (encrypt) a data encryption key with a master key\n *\n * @param dataKey - The data key to wrap (32 bytes)\n * @param masterKey - The master key to wrap with (32 bytes)\n * @returns Object containing wrapped key, IV, and auth tag (all base64-encoded)\n */\n static wrapKey(\n dataKey: Buffer,\n masterKey: Buffer,\n ): { wrappedKey: string; iv: string; authTag: string } {\n EnvelopeEncryption.validateKeyLength(dataKey);\n EnvelopeEncryption.validateKeyLength(masterKey);\n const iv = EnvelopeEncryption.generateIV();\n const cipher = crypto.createCipheriv(\n EnvelopeEncryption.ALGORITHM,\n masterKey,\n iv,\n );\n\n const encrypted = Buffer.concat([cipher.update(dataKey), cipher.final()]);\n const authTag = cipher.getAuthTag();\n\n return {\n wrappedKey: encrypted.toString('base64'),\n iv: iv.toString('base64'),\n authTag: authTag.toString('base64'),\n };\n }\n\n /**\n * Unwrap (decrypt) a data encryption key with a master key\n *\n * @param wrappedKey - Base64-encoded wrapped key\n * @param iv - Base64-encoded IV\n * @param authTag - Base64-encoded authentication tag\n * @param masterKey - The master key to unwrap with (32 bytes)\n * @returns The unwrapped data key (32 bytes)\n * @throws Error if decryption fails (invalid key, tampered data, etc.)\n */\n static unwrapKey(\n wrappedKey: string,\n iv: string,\n authTag: string,\n masterKey: Buffer,\n ): Buffer {\n EnvelopeEncryption.validateKeyLength(masterKey);\n const decipher = crypto.createDecipheriv(\n EnvelopeEncryption.ALGORITHM,\n masterKey,\n Buffer.from(iv, 'base64'),\n );\n decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n return Buffer.concat([\n decipher.update(Buffer.from(wrappedKey, 'base64')),\n decipher.final(),\n ]);\n }\n\n /**\n * Encrypt data with a data encryption key\n *\n * @param plaintext - The plaintext string to encrypt\n * @param dataKey - The data encryption key (32 bytes)\n * @returns Object containing ciphertext, IV, and auth tag (all base64-encoded)\n */\n static encryptData(\n plaintext: string,\n dataKey: Buffer,\n ): { ciphertext: string; iv: string; authTag: string } {\n EnvelopeEncryption.validateKeyLength(dataKey);\n const iv = EnvelopeEncryption.generateIV();\n const cipher = crypto.createCipheriv(\n EnvelopeEncryption.ALGORITHM,\n dataKey,\n iv,\n );\n\n const encrypted = Buffer.concat([\n cipher.update(plaintext, 'utf8'),\n cipher.final(),\n ]);\n const authTag = cipher.getAuthTag();\n\n return {\n ciphertext: encrypted.toString('base64'),\n iv: iv.toString('base64'),\n authTag: authTag.toString('base64'),\n };\n }\n\n /**\n * Decrypt data with a data encryption key\n *\n * @param ciphertext - Base64-encoded ciphertext\n * @param iv - Base64-encoded IV\n * @param authTag - Base64-encoded authentication tag\n * @param dataKey - The data encryption key (32 bytes)\n * @returns The decrypted plaintext string\n * @throws Error if decryption fails (invalid key, tampered data, etc.)\n */\n static decryptData(\n ciphertext: string,\n iv: string,\n authTag: string,\n dataKey: Buffer,\n ): string {\n EnvelopeEncryption.validateKeyLength(dataKey);\n const decipher = crypto.createDecipheriv(\n EnvelopeEncryption.ALGORITHM,\n dataKey,\n Buffer.from(iv, 'base64'),\n );\n decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n return Buffer.concat([\n decipher.update(Buffer.from(ciphertext, 'base64')),\n decipher.final(),\n ]).toString('utf8');\n }\n\n /**\n * Create a full encrypted envelope\n *\n * This combines key wrapping and data encryption into a single envelope\n * that can be stored and later decrypted.\n *\n * @param plaintext - The plaintext string to encrypt\n * @param dataKey - The data encryption key (32 bytes)\n * @param wrappedKeyInfo - The wrapped key info (from wrapKey)\n * @param amkKeyId - The ID of the AMK used to wrap the key\n * @param metadata - Optional metadata to include in the envelope\n * @returns A complete encrypted envelope\n */\n static createEnvelope(\n plaintext: string,\n dataKey: Buffer,\n wrappedKeyInfo: { wrappedKey: string; iv: string; authTag: string },\n amkKeyId: string,\n metadata?: Record<string, string>,\n ): EncryptedEnvelope {\n const encrypted = EnvelopeEncryption.encryptData(plaintext, dataKey);\n\n // Combine wrapped key info into a single string: wrappedKey:iv:authTag\n const combinedWrappedKey = `${wrappedKeyInfo.wrappedKey}:${wrappedKeyInfo.iv}:${wrappedKeyInfo.authTag}`;\n\n return {\n version: 1,\n algorithm: 'aes-256-gcm',\n wrappedKey: combinedWrappedKey,\n amkKeyId,\n iv: encrypted.iv,\n authTag: encrypted.authTag,\n ciphertext: encrypted.ciphertext,\n createdAt: new Date().toISOString(),\n metadata,\n };\n }\n\n /**\n * Parse a combined wrapped key string\n *\n * @param combinedWrappedKey - The combined wrapped key string (wrappedKey:iv:authTag)\n * @returns Object with wrappedKey, iv, and authTag\n */\n static parseWrappedKey(combinedWrappedKey: string): {\n wrappedKey: string;\n iv: string;\n authTag: string;\n } {\n const parts = combinedWrappedKey.split(':');\n if (parts.length !== 3) {\n throw new Error(\n 'Invalid wrapped key format: expected wrappedKey:iv:authTag',\n );\n }\n const [wrappedKey, iv, authTag] = parts;\n // Validate that all parts are non-empty\n if (!wrappedKey || !iv || !authTag) {\n throw new Error(\n 'Invalid wrapped key format: wrappedKey, iv, and authTag must all be non-empty',\n );\n }\n return { wrappedKey, iv, authTag };\n }\n\n /**\n * Decrypt a full envelope\n *\n * @param envelope - The encrypted envelope\n * @param masterKey - The master key to unwrap the data key\n * @returns The decrypted plaintext string\n */\n static decryptEnvelope(\n envelope: EncryptedEnvelope,\n masterKey: Buffer,\n ): string {\n // Parse the wrapped key\n const {\n wrappedKey,\n iv: keyIv,\n authTag: keyAuthTag,\n } = EnvelopeEncryption.parseWrappedKey(envelope.wrappedKey);\n\n // Unwrap the data key\n const dataKey = EnvelopeEncryption.unwrapKey(\n wrappedKey,\n keyIv,\n keyAuthTag,\n masterKey,\n );\n\n // Decrypt the data\n return EnvelopeEncryption.decryptData(\n envelope.ciphertext,\n envelope.iv,\n envelope.authTag,\n dataKey,\n );\n }\n\n /**\n * Validate that a key is the correct length\n *\n * @param key - The key to validate\n * @param expectedLength - Expected length in bytes (default: 32)\n * @throws Error if key length is invalid\n */\n static validateKeyLength(\n key: Buffer,\n expectedLength: number = EnvelopeEncryption.KEY_LENGTH,\n ): void {\n if (key.length !== expectedLength) {\n throw new Error(\n `Invalid key length: expected ${expectedLength} bytes, got ${key.length} bytes`,\n );\n }\n }\n\n /**\n * Parse a hex-encoded key from string\n *\n * @param hexKey - Hex-encoded key string (64 chars for 32 bytes)\n * @returns The key as a Buffer\n * @throws Error if the hex string is invalid\n */\n static parseHexKey(hexKey: string): Buffer {\n if (!/^[0-9a-fA-F]+$/.test(hexKey)) {\n throw new Error('Invalid hex key: contains non-hex characters');\n }\n\n const key = Buffer.from(hexKey, 'hex');\n EnvelopeEncryption.validateKeyLength(key);\n\n return key;\n }\n}\n","/**\n * Base error class for secret operations\n */\nexport class SecretError extends Error {\n readonly code: string;\n readonly adapterType?: string;\n readonly cause?: Error;\n\n constructor(\n message: string,\n code: string,\n options?: { adapterType?: string; cause?: Error },\n ) {\n super(message);\n this.name = 'SecretError';\n this.code = code;\n this.adapterType = options?.adapterType;\n this.cause = options?.cause;\n }\n}\n\n/**\n * Error thrown when a key is not found\n */\nexport class KeyNotFoundError extends SecretError {\n constructor(keyId: string, adapterType?: string) {\n super(`Key not found: ${keyId}`, 'KEY_NOT_FOUND', { adapterType });\n this.name = 'KeyNotFoundError';\n }\n}\n\n/**\n * Error thrown when decryption fails\n */\nexport class DecryptionError extends SecretError {\n constructor(message: string, adapterType?: string, cause?: Error) {\n super(message, 'DECRYPTION_FAILED', { adapterType, cause });\n this.name = 'DecryptionError';\n }\n}\n\n/**\n * Error thrown when encryption fails\n */\nexport class EncryptionError extends SecretError {\n constructor(message: string, adapterType?: string, cause?: Error) {\n super(message, 'ENCRYPTION_FAILED', { adapterType, cause });\n this.name = 'EncryptionError';\n }\n}\n\n/**\n * Error thrown when key rotation fails\n */\nexport class KeyRotationError extends SecretError {\n constructor(message: string, adapterType?: string, cause?: Error) {\n super(message, 'KEY_ROTATION_FAILED', { adapterType, cause });\n this.name = 'KeyRotationError';\n }\n}\n\n/**\n * Error thrown when a tenant's encryption key is missing\n */\nexport class TenantKeyMissingError extends SecretError {\n constructor(tenantId: string) {\n super(\n `No active encryption key for tenant: ${tenantId}`,\n 'TENANT_KEY_MISSING',\n );\n this.name = 'TenantKeyMissingError';\n }\n}\n\n/**\n * Error thrown when the Application Master Key is unavailable\n */\nexport class AMKUnavailableError extends SecretError {\n constructor(message: string) {\n super(message, 'AMK_UNAVAILABLE');\n this.name = 'AMKUnavailableError';\n }\n}\n\n/**\n * Error thrown when the store is not initialized\n */\nexport class StoreNotInitializedError extends SecretError {\n constructor(adapterType?: string) {\n super('Secret store not initialized', 'STORE_NOT_INITIALIZED', {\n adapterType,\n });\n this.name = 'StoreNotInitializedError';\n }\n}\n\n/**\n * Error thrown when an invalid key format is encountered\n */\nexport class InvalidKeyFormatError extends SecretError {\n constructor(message: string, adapterType?: string) {\n super(message, 'INVALID_KEY_FORMAT', { adapterType });\n this.name = 'InvalidKeyFormatError';\n }\n}\n","import { type DatabaseInterface, syncSchema } from '@happyvertical/sql';\nimport { createId } from '@happyvertical/utils';\nimport { EnvelopeEncryption } from '../shared/envelope.js';\nimport {\n AMKUnavailableError,\n DecryptionError,\n EncryptionError,\n KeyRotationError,\n StoreNotInitializedError,\n TenantKeyMissingError,\n} from '../shared/errors.js';\nimport type {\n ApplicationMasterKey,\n DatabaseSecretStoreOptions,\n DecryptedSecret,\n EncryptedEnvelope,\n EncryptOptions,\n SecretStore,\n SecretStoreEvent,\n SecretStoreEventListener,\n TenantDataEncryptionKey,\n Unsubscribe,\n} from '../shared/types.js';\n\n/**\n * Default rotation period in milliseconds (90 days)\n */\nconst DEFAULT_ROTATION_PERIOD_MS = 90 * 24 * 60 * 60 * 1000;\n\n/**\n * Database-backed secret store\n *\n * Uses envelope encryption with AES-256-GCM:\n * - Application Master Key (AMK) from environment variable\n * - Per-tenant Data Encryption Keys (TDEKs) wrapped by AMK\n * - Secrets encrypted by unwrapped TDEKs\n *\n * @example\n * ```typescript\n * const store = new DatabaseSecretStore({\n * type: 'database',\n * db,\n * amk: {\n * provider: 'env',\n * keyEnvVar: 'SECRET_MASTER_KEY',\n * keyId: 'amk-v1'\n * }\n * });\n *\n * await store.initialize();\n *\n * // Encrypt a secret for a tenant\n * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');\n *\n * // Decrypt\n * const { value } = await store.decrypt('tenant-123', envelope);\n * ```\n */\nexport class DatabaseSecretStore implements SecretStore {\n private db: DatabaseInterface;\n private keysTable: string;\n private amkConfig: DatabaseSecretStoreOptions['amk'];\n private cachedAmk: Buffer | null = null;\n private initialized = false;\n private listeners: SecretStoreEventListener[] = [];\n\n constructor(options: DatabaseSecretStoreOptions) {\n this.db = options.db;\n\n // Validate table name to prevent SQL injection via identifier interpolation\n const tableName = options.keysTable ?? 'tenant_encryption_keys';\n if (!/^[A-Za-z0-9_]+$/.test(tableName)) {\n throw new Error(\n `Invalid keysTable name \"${tableName}\". Table name must contain only alphanumeric characters and underscores.`,\n );\n }\n this.keysTable = tableName;\n\n this.amkConfig = options.amk;\n }\n\n /**\n * Initialize the store (create schema if needed)\n */\n async initialize(): Promise<void> {\n if (this.initialized) return;\n\n // Create the tenant keys table\n const schema = `\n CREATE TABLE IF NOT EXISTS \"${this.keysTable}\" (\n id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n wrapped_key TEXT NOT NULL,\n amk_key_id TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'active',\n version INTEGER NOT NULL DEFAULT 1,\n rotate_after TEXT,\n retired_at TEXT,\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL\n );\n\n CREATE INDEX IF NOT EXISTS \"idx_${this.keysTable}_tenant_status\"\n ON \"${this.keysTable}\" (tenant_id, status);\n\n CREATE INDEX IF NOT EXISTS \"idx_${this.keysTable}_rotate_after\"\n ON \"${this.keysTable}\" (rotate_after)\n WHERE status = 'active';\n `;\n\n await syncSchema({ db: this.db, schema });\n\n this.initialized = true;\n }\n\n /**\n * Get the Application Master Key from environment\n */\n private getAMK(): Buffer {\n if (this.cachedAmk) {\n return this.cachedAmk;\n }\n\n const keyHex = process.env[this.amkConfig.keyEnvVar];\n if (!keyHex) {\n throw new AMKUnavailableError(\n `Application Master Key not found in environment variable: ${this.amkConfig.keyEnvVar}`,\n );\n }\n\n try {\n const key = EnvelopeEncryption.parseHexKey(keyHex);\n this.cachedAmk = key;\n return key;\n } catch (error) {\n throw new AMKUnavailableError(\n `Invalid AMK in ${this.amkConfig.keyEnvVar}: ${(error as Error).message}`,\n );\n }\n }\n\n /**\n * Ensure the store is initialized\n */\n private ensureInitialized(): void {\n if (!this.initialized) {\n throw new StoreNotInitializedError('database');\n }\n }\n\n /**\n * Emit an event to all listeners\n */\n private async emitEvent(event: SecretStoreEvent): Promise<void> {\n for (const listener of this.listeners) {\n await listener(event);\n }\n }\n\n /**\n * Subscribe to store events\n */\n subscribe(listener: SecretStoreEventListener): Unsubscribe {\n this.listeners.push(listener);\n return () => {\n const index = this.listeners.indexOf(listener);\n if (index !== -1) {\n this.listeners.splice(index, 1);\n }\n };\n }\n\n async encrypt(\n tenantId: string,\n secretName: string,\n plaintext: string,\n options?: EncryptOptions,\n ): Promise<EncryptedEnvelope> {\n this.ensureInitialized();\n\n // Input validation\n if (typeof tenantId !== 'string' || tenantId.trim().length === 0) {\n throw new EncryptionError(\n 'Invalid tenantId provided for encryption',\n 'database',\n );\n }\n if (typeof secretName !== 'string' || secretName.trim().length === 0) {\n throw new EncryptionError(\n 'Invalid secretName provided for encryption',\n 'database',\n );\n }\n\n let dataKey: Buffer | null = null;\n try {\n // Get or create tenant's data encryption key\n let tenantKey = await this.getTenantKey(tenantId);\n if (!tenantKey) {\n tenantKey = await this.createTenantKey(tenantId);\n }\n\n // Get AMK and unwrap the TDEK\n const amk = this.getAMK();\n const {\n wrappedKey,\n iv: keyIv,\n authTag: keyAuthTag,\n } = EnvelopeEncryption.parseWrappedKey(tenantKey.wrappedKey);\n dataKey = EnvelopeEncryption.unwrapKey(\n wrappedKey,\n keyIv,\n keyAuthTag,\n amk,\n );\n\n // Create the envelope using the unwrapped TDEK\n const envelope = EnvelopeEncryption.createEnvelope(\n plaintext,\n dataKey,\n { wrappedKey, iv: keyIv, authTag: keyAuthTag },\n tenantKey.amkKeyId,\n options?.metadata,\n );\n\n // Emit event\n await this.emitEvent({\n type: 'secret.encrypted',\n tenantId,\n keyId: tenantKey.keyId,\n secretName,\n timestamp: new Date(),\n });\n\n return envelope;\n } catch (error) {\n if (\n error instanceof AMKUnavailableError ||\n error instanceof TenantKeyMissingError\n ) {\n throw error;\n }\n throw new EncryptionError(\n `Failed to encrypt secret '${secretName}' for tenant ${tenantId}: ${(error as Error).message}`,\n 'database',\n error instanceof Error ? error : undefined,\n );\n } finally {\n // Zero out the data key buffer to prevent key material from remaining in memory\n if (dataKey && Buffer.isBuffer(dataKey)) {\n dataKey.fill(0);\n }\n }\n }\n\n async decrypt(\n tenantId: string,\n envelope: EncryptedEnvelope,\n ): Promise<DecryptedSecret> {\n this.ensureInitialized();\n\n // Input validation\n if (typeof tenantId !== 'string' || tenantId.trim().length === 0) {\n throw new DecryptionError(\n 'Invalid tenantId provided for decryption',\n 'database',\n );\n }\n\n // Get all key versions for this tenant (including retired keys for decryption)\n const tenantKeys = await this.listKeyVersions(tenantId);\n if (tenantKeys.length === 0) {\n throw new TenantKeyMissingError(tenantId);\n }\n\n // Verify that the envelope's wrapped key belongs to this tenant\n // Extract the wrapped key portion from the envelope (format: wrappedKey:iv:authTag)\n const envelopeWrappedKeyParts = envelope.wrappedKey.split(':');\n const envelopeWrappedKey = envelopeWrappedKeyParts[0];\n\n const matchingKey = tenantKeys.find((key) => {\n const keyParts = key.wrappedKey.split(':');\n return keyParts[0] === envelopeWrappedKey;\n });\n\n if (!matchingKey) {\n throw new DecryptionError(\n `Envelope was not encrypted with a key belonging to tenant ${tenantId}`,\n 'database',\n );\n }\n\n try {\n // Get AMK and decrypt the envelope\n const amk = this.getAMK();\n const plaintext = EnvelopeEncryption.decryptEnvelope(envelope, amk);\n\n // Emit event\n await this.emitEvent({\n type: 'secret.decrypted',\n tenantId,\n keyId: matchingKey.keyId,\n timestamp: new Date(),\n });\n\n return {\n value: plaintext,\n keyId: matchingKey.keyId,\n createdAt: new Date(envelope.createdAt),\n metadata: envelope.metadata,\n };\n } catch (error) {\n if (error instanceof AMKUnavailableError) {\n throw error;\n }\n throw new DecryptionError(\n `Failed to decrypt secret for tenant ${tenantId}: ${(error as Error).message}`,\n 'database',\n error instanceof Error ? error : undefined,\n );\n }\n }\n\n async getTenantKey(\n tenantId: string,\n ): Promise<TenantDataEncryptionKey | null> {\n this.ensureInitialized();\n\n const row = await this.db.get(this.keysTable, {\n tenant_id: tenantId,\n status: 'active',\n });\n\n if (!row) return null;\n\n return this.parseKeyRow(row as Record<string, unknown>);\n }\n\n async createTenantKey(tenantId: string): Promise<TenantDataEncryptionKey> {\n this.ensureInitialized();\n\n // Generate and wrap a new data key\n const amk = this.getAMK();\n const dataKey = EnvelopeEncryption.generateDataKey();\n const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);\n\n const keyId = createId();\n const wrappedKeyStr = `${wrapped.wrappedKey}:${wrapped.iv}:${wrapped.authTag}`;\n const now = new Date();\n const rotateAfter = new Date(now.getTime() + DEFAULT_ROTATION_PERIOD_MS);\n\n await this.db.insert(this.keysTable, {\n id: keyId,\n tenant_id: tenantId,\n wrapped_key: wrappedKeyStr,\n amk_key_id: this.amkConfig.keyId,\n status: 'active',\n version: 1,\n rotate_after: rotateAfter.toISOString(),\n created_at: now.toISOString(),\n updated_at: now.toISOString(),\n });\n\n // Emit event\n await this.emitEvent({\n type: 'key.created',\n tenantId,\n keyId,\n timestamp: now,\n });\n\n return {\n keyId,\n tenantId,\n wrappedKey: wrappedKeyStr,\n amkKeyId: this.amkConfig.keyId,\n status: 'active',\n version: 1,\n createdAt: now,\n rotateAfter,\n };\n }\n\n async rotateTenantKey(tenantId: string): Promise<TenantDataEncryptionKey> {\n this.ensureInitialized();\n\n const currentKey = await this.getTenantKey(tenantId);\n if (!currentKey) {\n throw new TenantKeyMissingError(tenantId);\n }\n\n const now = new Date();\n\n try {\n // Mark current key as rotating\n await this.db.update(\n this.keysTable,\n { id: currentKey.keyId },\n { status: 'rotating', updated_at: now.toISOString() },\n );\n\n // Create new key with incremented version\n const amk = this.getAMK();\n const dataKey = EnvelopeEncryption.generateDataKey();\n const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);\n\n const newKeyId = createId();\n const wrappedKeyStr = `${wrapped.wrappedKey}:${wrapped.iv}:${wrapped.authTag}`;\n const rotateAfter = new Date(now.getTime() + DEFAULT_ROTATION_PERIOD_MS);\n\n await this.db.insert(this.keysTable, {\n id: newKeyId,\n tenant_id: tenantId,\n wrapped_key: wrappedKeyStr,\n amk_key_id: this.amkConfig.keyId,\n status: 'active',\n version: currentKey.version + 1,\n rotate_after: rotateAfter.toISOString(),\n created_at: now.toISOString(),\n updated_at: now.toISOString(),\n });\n\n // Mark old key as retired\n await this.db.update(\n this.keysTable,\n { id: currentKey.keyId },\n {\n status: 'retired',\n retired_at: now.toISOString(),\n updated_at: now.toISOString(),\n },\n );\n\n // Emit event\n await this.emitEvent({\n type: 'key.rotated',\n tenantId,\n keyId: newKeyId,\n timestamp: now,\n });\n\n return {\n keyId: newKeyId,\n tenantId,\n wrappedKey: wrappedKeyStr,\n amkKeyId: this.amkConfig.keyId,\n status: 'active',\n version: currentKey.version + 1,\n createdAt: now,\n rotateAfter,\n };\n } catch (error) {\n throw new KeyRotationError(\n `Failed to rotate key for tenant ${tenantId}: ${(error as Error).message}`,\n 'database',\n error instanceof Error ? error : undefined,\n );\n }\n }\n\n async retireTenantKey(tenantId: string, keyId: string): Promise<void> {\n this.ensureInitialized();\n\n const now = new Date();\n\n await this.db.update(\n this.keysTable,\n { id: keyId, tenant_id: tenantId },\n {\n status: 'retired',\n retired_at: now.toISOString(),\n updated_at: now.toISOString(),\n },\n );\n\n // Emit event\n await this.emitEvent({\n type: 'key.retired',\n tenantId,\n keyId,\n timestamp: now,\n });\n }\n\n async getActiveAMK(): Promise<ApplicationMasterKey> {\n // Validate that the AMK is accessible\n this.getAMK();\n\n return {\n keyId: this.amkConfig.keyId,\n description: `AMK from env var ${this.amkConfig.keyEnvVar}`,\n status: 'active',\n provider: 'env',\n keyReference: this.amkConfig.keyEnvVar,\n createdAt: new Date(),\n };\n }\n\n async rewrapTenantKey(\n _tenantId: string,\n _newAmkKeyId: string,\n ): Promise<TenantDataEncryptionKey> {\n // For env-based AMK, this would require:\n // 1. Having both old and new AMK available\n // 2. Unwrapping with old AMK\n // 3. Rewrapping with new AMK\n // This is complex and risky for env-based keys\n throw new Error(\n 'AMK rotation not supported for env-based keys. ' +\n 'Use AWS KMS, Vault, or Azure Key Vault for AMK rotation support.',\n );\n }\n\n async listKeyVersions(tenantId: string): Promise<TenantDataEncryptionKey[]> {\n this.ensureInitialized();\n\n const { rows } = await this.db.query(\n `SELECT * FROM \"${this.keysTable}\" WHERE tenant_id = ? ORDER BY version DESC`,\n tenantId,\n );\n\n return rows.map((row: Record<string, unknown>) => this.parseKeyRow(row));\n }\n\n /**\n * Parse a database row into a TenantDataEncryptionKey\n */\n private parseKeyRow(row: Record<string, unknown>): TenantDataEncryptionKey {\n return {\n keyId: row.id as string,\n tenantId: row.tenant_id as string,\n wrappedKey: row.wrapped_key as string,\n amkKeyId: row.amk_key_id as string,\n status: row.status as TenantDataEncryptionKey['status'],\n version: row.version as number,\n createdAt: new Date(row.created_at as string),\n rotateAfter: row.rotate_after\n ? new Date(row.rotate_after as string)\n : undefined,\n retiredAt: row.retired_at\n ? new Date(row.retired_at as string)\n : undefined,\n };\n }\n}\n\nexport default DatabaseSecretStore;\n","import type {\n AWSKMSSecretStoreOptions,\n AzureKeyVaultSecretStoreOptions,\n DatabaseSecretStoreOptions,\n GetSecretStoreOptions,\n SecretStore,\n VaultSecretStoreOptions,\n} from './types.js';\n\n/**\n * Type guard for database options\n */\nexport function isDatabaseOptions(\n opts: GetSecretStoreOptions,\n): opts is DatabaseSecretStoreOptions {\n return opts.type === 'database';\n}\n\n/**\n * Type guard for AWS KMS options\n */\nexport function isAWSKMSOptions(\n opts: GetSecretStoreOptions,\n): opts is AWSKMSSecretStoreOptions {\n return opts.type === 'aws-kms';\n}\n\n/**\n * Type guard for Vault options\n */\nexport function isVaultOptions(\n opts: GetSecretStoreOptions,\n): opts is VaultSecretStoreOptions {\n return opts.type === 'vault';\n}\n\n/**\n * Type guard for Azure Key Vault options\n */\nexport function isAzureKeyVaultOptions(\n opts: GetSecretStoreOptions,\n): opts is AzureKeyVaultSecretStoreOptions {\n return opts.type === 'azure-keyvault';\n}\n\n/**\n * Factory function to create secret store instances\n *\n * Uses lazy imports to avoid loading unnecessary adapters and their dependencies.\n *\n * @example\n * ```typescript\n * // Database-backed store with env-based AMK\n * const store = await getSecretStore({\n * type: 'database',\n * db,\n * amk: {\n * provider: 'env',\n * keyEnvVar: 'SECRET_MASTER_KEY',\n * keyId: 'amk-v1'\n * }\n * });\n *\n * // Encrypt a secret\n * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');\n *\n * // Decrypt\n * const decrypted = await store.decrypt('tenant-123', envelope);\n * ```\n */\nexport async function getSecretStore(\n options: GetSecretStoreOptions,\n): Promise<SecretStore> {\n if (isDatabaseOptions(options)) {\n const { DatabaseSecretStore } = await import('../adapters/database.js');\n const store = new DatabaseSecretStore(options);\n await store.initialize();\n return store;\n }\n\n if (isAWSKMSOptions(options)) {\n // Phase 2: AWS KMS adapter\n throw new Error(\n 'AWS KMS adapter not yet implemented. Coming in a future release.',\n );\n }\n\n if (isVaultOptions(options)) {\n // Phase 2: HashiCorp Vault adapter\n throw new Error(\n 'HashiCorp Vault adapter not yet implemented. Coming in a future release.',\n );\n }\n\n if (isAzureKeyVaultOptions(options)) {\n // Phase 2: Azure Key Vault adapter\n throw new Error(\n 'Azure Key Vault adapter not yet implemented. Coming in a future release.',\n );\n }\n\n throw new Error(\n `Unsupported secret store type: ${(options as { type: string }).type}`,\n );\n}\n","/**\n * @happyvertical/secrets\n *\n * Envelope encryption for per-tenant secret management with pluggable backends.\n *\n * @example\n * ```typescript\n * import { getSecretStore } from '@happyvertical/secrets';\n * import { getDatabase } from '@happyvertical/sql';\n *\n * // Get a database connection\n * const db = await getDatabase({ type: 'sqlite', url: ':memory:' });\n *\n * // Create a secret store\n * const store = await getSecretStore({\n * type: 'database',\n * db,\n * amk: {\n * provider: 'env',\n * keyEnvVar: 'SECRET_MASTER_KEY', // 64 hex chars (32 bytes)\n * keyId: 'amk-v1'\n * }\n * });\n *\n * // Encrypt a secret for a tenant\n * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');\n *\n * // Decrypt the secret\n * const { value } = await store.decrypt('tenant-123', envelope);\n * console.log(value); // 'sk_live_xxx'\n *\n * // Rotate tenant's encryption key\n * await store.rotateTenantKey('tenant-123');\n * ```\n *\n * @packageDocumentation\n */\n\n// Direct adapter exports (for advanced usage)\nexport { DatabaseSecretStore } from './adapters/database.js';\n// Envelope encryption primitives\nexport { EnvelopeEncryption } from './shared/envelope.js';\n// Error classes\nexport {\n AMKUnavailableError,\n DecryptionError,\n EncryptionError,\n InvalidKeyFormatError,\n KeyNotFoundError,\n KeyRotationError,\n SecretError,\n StoreNotInitializedError,\n TenantKeyMissingError,\n} from './shared/errors.js';\n\n// Factory function\nexport {\n getSecretStore,\n isAWSKMSOptions,\n isAzureKeyVaultOptions,\n isDatabaseOptions,\n isVaultOptions,\n} from './shared/factory.js';\n// Core types\nexport type {\n // Adapter options\n AMKConfig,\n ApplicationMasterKey,\n AWSKMSSecretStoreOptions,\n AzureKeyVaultSecretStoreOptions,\n DatabaseSecretStoreOptions,\n DecryptedSecret,\n EncryptedEnvelope,\n EncryptOptions,\n GetSecretStoreOptions,\n SecretAdapterType,\n SecretStore,\n SecretStoreEvent,\n SecretStoreEventListener,\n SecretStoreEventType,\n TenantDataEncryptionKey,\n Unsubscribe,\n VaultSecretStoreOptions,\n} from './shared/types.js';\n\n/** @internal */\nexport const PACKAGE_VERSION_INITIALIZED = true;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,IAAa,qBAAb,MAAa,mBAAmB;CAC9B,OAAwB,YAAY;CACpC,OAAwB,aAAa;CACrC,OAAwB,YAAY;CACpC,OAAwB,kBAAkB;;;;;;CAO1C,OAAO,kBAA0B;EAC/B,OAAO,OAAO,YAAY,mBAAmB,UAAU;CACzD;;;;;;CAOA,OAAO,aAAqB;EAC1B,OAAO,OAAO,YAAY,mBAAmB,SAAS;CACxD;;;;;;;;CASA,OAAO,QACL,SACA,WACqD;EACrD,mBAAmB,kBAAkB,OAAO;EAC5C,mBAAmB,kBAAkB,SAAS;EAC9C,MAAM,KAAK,mBAAmB,WAAW;EACzC,MAAM,SAAS,OAAO,eACpB,mBAAmB,WACnB,WACA,EACF;EAEA,MAAM,YAAY,OAAO,OAAO,CAAC,OAAO,OAAO,OAAO,GAAG,OAAO,MAAM,CAAC,CAAC;EACxE,MAAM,UAAU,OAAO,WAAW;EAElC,OAAO;GACL,YAAY,UAAU,SAAS,QAAQ;GACvC,IAAI,GAAG,SAAS,QAAQ;GACxB,SAAS,QAAQ,SAAS,QAAQ;EACpC;CACF;;;;;;;;;;;CAYA,OAAO,UACL,YACA,IACA,SACA,WACQ;EACR,mBAAmB,kBAAkB,SAAS;EAC9C,MAAM,WAAW,OAAO,iBACtB,mBAAmB,WACnB,WACA,OAAO,KAAK,IAAI,QAAQ,CAC1B;EACA,SAAS,WAAW,OAAO,KAAK,SAAS,QAAQ,CAAC;EAElD,OAAO,OAAO,OAAO,CACnB,SAAS,OAAO,OAAO,KAAK,YAAY,QAAQ,CAAC,GACjD,SAAS,MAAM,CACjB,CAAC;CACH;;;;;;;;CASA,OAAO,YACL,WACA,SACqD;EACrD,mBAAmB,kBAAkB,OAAO;EAC5C,MAAM,KAAK,mBAAmB,WAAW;EACzC,MAAM,SAAS,OAAO,eACpB,mBAAmB,WACnB,SACA,EACF;EAEA,MAAM,YAAY,OAAO,OAAO,CAC9B,OAAO,OAAO,WAAW,MAAM,GAC/B,OAAO,MAAM,CACf,CAAC;EACD,MAAM,UAAU,OAAO,WAAW;EAElC,OAAO;GACL,YAAY,UAAU,SAAS,QAAQ;GACvC,IAAI,GAAG,SAAS,QAAQ;GACxB,SAAS,QAAQ,SAAS,QAAQ;EACpC;CACF;;;;;;;;;;;CAYA,OAAO,YACL,YACA,IACA,SACA,SACQ;EACR,mBAAmB,kBAAkB,OAAO;EAC5C,MAAM,WAAW,OAAO,iBACtB,mBAAmB,WACnB,SACA,OAAO,KAAK,IAAI,QAAQ,CAC1B;EACA,SAAS,WAAW,OAAO,KAAK,SAAS,QAAQ,CAAC;EAElD,OAAO,OAAO,OAAO,CACnB,SAAS,OAAO,OAAO,KAAK,YAAY,QAAQ,CAAC,GACjD,SAAS,MAAM,CACjB,CAAC,CAAC,CAAC,SAAS,MAAM;CACpB;;;;;;;;;;;;;;CAeA,OAAO,eACL,WACA,SACA,gBACA,UACA,UACmB;EACnB,MAAM,YAAY,mBAAmB,YAAY,WAAW,OAAO;EAKnE,OAAO;GACL,SAAS;GACT,WAAW;GACX,YAAY,GALgB,eAAe,WAAW,GAAG,eAAe,GAAG,GAAG,eAAe;GAM7F;GACA,IAAI,UAAU;GACd,SAAS,UAAU;GACnB,YAAY,UAAU;GACtB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC;EACF;CACF;;;;;;;CAQA,OAAO,gBAAgB,oBAIrB;EACA,MAAM,QAAQ,mBAAmB,MAAM,GAAG;EAC1C,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MACR,4DACF;EAEF,MAAM,CAAC,YAAY,IAAI,WAAW;EAElC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SACzB,MAAM,IAAI,MACR,+EACF;EAEF,OAAO;GAAE;GAAY;GAAI;EAAQ;CACnC;;;;;;;;CASA,OAAO,gBACL,UACA,WACQ;EAER,MAAM,EACJ,YACA,IAAI,OACJ,SAAS,eACP,mBAAmB,gBAAgB,SAAS,UAAU;EAG1D,MAAM,UAAU,mBAAmB,UACjC,YACA,OACA,YACA,SACF;EAGA,OAAO,mBAAmB,YACxB,SAAS,YACT,SAAS,IACT,SAAS,SACT,OACF;CACF;;;;;;;;CASA,OAAO,kBACL,KACA,iBAAyB,mBAAmB,YACtC;EACN,IAAI,IAAI,WAAW,gBACjB,MAAM,IAAI,MACR,gCAAgC,eAAe,cAAc,IAAI,OAAO,OAC1E;CAEJ;;;;;;;;CASA,OAAO,YAAY,QAAwB;EACzC,IAAI,CAAC,iBAAiB,KAAK,MAAM,GAC/B,MAAM,IAAI,MAAM,8CAA8C;EAGhE,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK;EACrC,mBAAmB,kBAAkB,GAAG;EAExC,OAAO;CACT;AACF;;;;;;ACjTA,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CAEA,YACE,SACA,MACA,SACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,cAAc,SAAS;EAC5B,KAAK,QAAQ,SAAS;CACxB;AACF;;;;AAKA,IAAa,mBAAb,cAAsC,YAAY;CAChD,YAAY,OAAe,aAAsB;EAC/C,MAAM,kBAAkB,SAAS,iBAAiB,EAAE,YAAY,CAAC;EACjE,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,YAAY;CAC/C,YAAY,SAAiB,aAAsB,OAAe;EAChE,MAAM,SAAS,qBAAqB;GAAE;GAAa;EAAM,CAAC;EAC1D,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,YAAY;CAC/C,YAAY,SAAiB,aAAsB,OAAe;EAChE,MAAM,SAAS,qBAAqB;GAAE;GAAa;EAAM,CAAC;EAC1D,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,mBAAb,cAAsC,YAAY;CAChD,YAAY,SAAiB,aAAsB,OAAe;EAChE,MAAM,SAAS,uBAAuB;GAAE;GAAa;EAAM,CAAC;EAC5D,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,wBAAb,cAA2C,YAAY;CACrD,YAAY,UAAkB;EAC5B,MACE,wCAAwC,YACxC,oBACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,sBAAb,cAAyC,YAAY;CACnD,YAAY,SAAiB;EAC3B,MAAM,SAAS,iBAAiB;EAChC,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,2BAAb,cAA8C,YAAY;CACxD,YAAY,aAAsB;EAChC,MAAM,gCAAgC,yBAAyB,EAC7D,YACF,CAAC;EACD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,wBAAb,cAA2C,YAAY;CACrD,YAAY,SAAiB,aAAsB;EACjD,MAAM,SAAS,sBAAsB,EAAE,YAAY,CAAC;EACpD,KAAK,OAAO;CACd;AACF;;;;;;;;;;AC7EA,IAAM,6BAA6B,OAAU,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BvD,IAAa,sBAAb,MAAwD;CACtD;CACA;CACA;CACA,YAAmC;CACnC,cAAsB;CACtB,YAAgD,CAAC;CAEjD,YAAY,SAAqC;EAC/C,KAAK,KAAK,QAAQ;EAGlB,MAAM,YAAY,QAAQ,aAAa;EACvC,IAAI,CAAC,kBAAkB,KAAK,SAAS,GACnC,MAAM,IAAI,MACR,2BAA2B,UAAU,yEACvC;EAEF,KAAK,YAAY;EAEjB,KAAK,YAAY,QAAQ;CAC3B;;;;CAKA,MAAM,aAA4B;EAChC,IAAI,KAAK,aAAa;EAGtB,MAAM,SAAS;oCACiB,KAAK,UAAU;;;;;;;;;;;;;wCAaX,KAAK,UAAU;cACzC,KAAK,UAAU;;wCAEW,KAAK,UAAU;cACzC,KAAK,UAAU;;;EAIzB,MAAM,WAAW;GAAE,IAAI,KAAK;GAAI;EAAO,CAAC;EAExC,KAAK,cAAc;CACrB;;;;CAKA,SAAyB;EACvB,IAAI,KAAK,WACP,OAAO,KAAK;EAGd,MAAM,SAAS,QAAQ,IAAI,KAAK,UAAU;EAC1C,IAAI,CAAC,QACH,MAAM,IAAI,oBACR,6DAA6D,KAAK,UAAU,WAC9E;EAGF,IAAI;GACF,MAAM,MAAM,mBAAmB,YAAY,MAAM;GACjD,KAAK,YAAY;GACjB,OAAO;EACT,SAAS,OAAO;GACd,MAAM,IAAI,oBACR,kBAAkB,KAAK,UAAU,UAAU,IAAK,MAAgB,SAClE;EACF;CACF;;;;CAKA,oBAAkC;EAChC,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,yBAAyB,UAAU;CAEjD;;;;CAKA,MAAc,UAAU,OAAwC;EAC9D,KAAK,MAAM,YAAY,KAAK,WAC1B,MAAM,SAAS,KAAK;CAExB;;;;CAKA,UAAU,UAAiD;EACzD,KAAK,UAAU,KAAK,QAAQ;EAC5B,aAAa;GACX,MAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;GAC7C,IAAI,UAAU,IACZ,KAAK,UAAU,OAAO,OAAO,CAAC;EAElC;CACF;CAEA,MAAM,QACJ,UACA,YACA,WACA,SAC4B;EAC5B,KAAK,kBAAkB;EAGvB,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,GAC7D,MAAM,IAAI,gBACR,4CACA,UACF;EAEF,IAAI,OAAO,eAAe,YAAY,WAAW,KAAK,CAAC,CAAC,WAAW,GACjE,MAAM,IAAI,gBACR,8CACA,UACF;EAGF,IAAI,UAAyB;EAC7B,IAAI;GAEF,IAAI,YAAY,MAAM,KAAK,aAAa,QAAQ;GAChD,IAAI,CAAC,WACH,YAAY,MAAM,KAAK,gBAAgB,QAAQ;GAIjD,MAAM,MAAM,KAAK,OAAO;GACxB,MAAM,EACJ,YACA,IAAI,OACJ,SAAS,eACP,mBAAmB,gBAAgB,UAAU,UAAU;GAC3D,UAAU,mBAAmB,UAC3B,YACA,OACA,YACA,GACF;GAGA,MAAM,WAAW,mBAAmB,eAClC,WACA,SACA;IAAE;IAAY,IAAI;IAAO,SAAS;GAAW,GAC7C,UAAU,UACV,SAAS,QACX;GAGA,MAAM,KAAK,UAAU;IACnB,MAAM;IACN;IACA,OAAO,UAAU;IACjB;IACA,2BAAW,IAAI,KAAK;GACtB,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,IACE,iBAAiB,uBACjB,iBAAiB,uBAEjB,MAAM;GAER,MAAM,IAAI,gBACR,6BAA6B,WAAW,eAAe,SAAS,IAAK,MAAgB,WACrF,YACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF,UAAU;GAER,IAAI,WAAW,OAAO,SAAS,OAAO,GACpC,QAAQ,KAAK,CAAC;EAElB;CACF;CAEA,MAAM,QACJ,UACA,UAC0B;EAC1B,KAAK,kBAAkB;EAGvB,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,GAC7D,MAAM,IAAI,gBACR,4CACA,UACF;EAIF,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;EACtD,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,sBAAsB,QAAQ;EAM1C,MAAM,qBAD0B,SAAS,WAAW,MAAM,GAC/B,CAAA,CAAwB;EAEnD,MAAM,cAAc,WAAW,MAAM,QAAQ;GAE3C,OADiB,IAAI,WAAW,MAAM,GAC/B,CAAA,CAAS,OAAO;EACzB,CAAC;EAED,IAAI,CAAC,aACH,MAAM,IAAI,gBACR,6DAA6D,YAC7D,UACF;EAGF,IAAI;GAEF,MAAM,MAAM,KAAK,OAAO;GACxB,MAAM,YAAY,mBAAmB,gBAAgB,UAAU,GAAG;GAGlE,MAAM,KAAK,UAAU;IACnB,MAAM;IACN;IACA,OAAO,YAAY;IACnB,2BAAW,IAAI,KAAK;GACtB,CAAC;GAED,OAAO;IACL,OAAO;IACP,OAAO,YAAY;IACnB,WAAW,IAAI,KAAK,SAAS,SAAS;IACtC,UAAU,SAAS;GACrB;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,qBACnB,MAAM;GAER,MAAM,IAAI,gBACR,uCAAuC,SAAS,IAAK,MAAgB,WACrE,YACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF;CACF;CAEA,MAAM,aACJ,UACyC;EACzC,KAAK,kBAAkB;EAEvB,MAAM,MAAM,MAAM,KAAK,GAAG,IAAI,KAAK,WAAW;GAC5C,WAAW;GACX,QAAQ;EACV,CAAC;EAED,IAAI,CAAC,KAAK,OAAO;EAEjB,OAAO,KAAK,YAAY,GAA8B;CACxD;CAEA,MAAM,gBAAgB,UAAoD;EACxE,KAAK,kBAAkB;EAGvB,MAAM,MAAM,KAAK,OAAO;EACxB,MAAM,UAAU,mBAAmB,gBAAgB;EACnD,MAAM,UAAU,mBAAmB,QAAQ,SAAS,GAAG;EAEvD,MAAM,QAAQ,SAAS;EACvB,MAAM,gBAAgB,GAAG,QAAQ,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ;EACrE,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,cAAc,IAAI,KAAK,IAAI,QAAQ,IAAI,0BAA0B;EAEvE,MAAM,KAAK,GAAG,OAAO,KAAK,WAAW;GACnC,IAAI;GACJ,WAAW;GACX,aAAa;GACb,YAAY,KAAK,UAAU;GAC3B,QAAQ;GACR,SAAS;GACT,cAAc,YAAY,YAAY;GACtC,YAAY,IAAI,YAAY;GAC5B,YAAY,IAAI,YAAY;EAC9B,CAAC;EAGD,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA;GACA,WAAW;EACb,CAAC;EAED,OAAO;GACL;GACA;GACA,YAAY;GACZ,UAAU,KAAK,UAAU;GACzB,QAAQ;GACR,SAAS;GACT,WAAW;GACX;EACF;CACF;CAEA,MAAM,gBAAgB,UAAoD;EACxE,KAAK,kBAAkB;EAEvB,MAAM,aAAa,MAAM,KAAK,aAAa,QAAQ;EACnD,IAAI,CAAC,YACH,MAAM,IAAI,sBAAsB,QAAQ;EAG1C,MAAM,sBAAM,IAAI,KAAK;EAErB,IAAI;GAEF,MAAM,KAAK,GAAG,OACZ,KAAK,WACL,EAAE,IAAI,WAAW,MAAM,GACvB;IAAE,QAAQ;IAAY,YAAY,IAAI,YAAY;GAAE,CACtD;GAGA,MAAM,MAAM,KAAK,OAAO;GACxB,MAAM,UAAU,mBAAmB,gBAAgB;GACnD,MAAM,UAAU,mBAAmB,QAAQ,SAAS,GAAG;GAEvD,MAAM,WAAW,SAAS;GAC1B,MAAM,gBAAgB,GAAG,QAAQ,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ;GACrE,MAAM,cAAc,IAAI,KAAK,IAAI,QAAQ,IAAI,0BAA0B;GAEvE,MAAM,KAAK,GAAG,OAAO,KAAK,WAAW;IACnC,IAAI;IACJ,WAAW;IACX,aAAa;IACb,YAAY,KAAK,UAAU;IAC3B,QAAQ;IACR,SAAS,WAAW,UAAU;IAC9B,cAAc,YAAY,YAAY;IACtC,YAAY,IAAI,YAAY;IAC5B,YAAY,IAAI,YAAY;GAC9B,CAAC;GAGD,MAAM,KAAK,GAAG,OACZ,KAAK,WACL,EAAE,IAAI,WAAW,MAAM,GACvB;IACE,QAAQ;IACR,YAAY,IAAI,YAAY;IAC5B,YAAY,IAAI,YAAY;GAC9B,CACF;GAGA,MAAM,KAAK,UAAU;IACnB,MAAM;IACN;IACA,OAAO;IACP,WAAW;GACb,CAAC;GAED,OAAO;IACL,OAAO;IACP;IACA,YAAY;IACZ,UAAU,KAAK,UAAU;IACzB,QAAQ;IACR,SAAS,WAAW,UAAU;IAC9B,WAAW;IACX;GACF;EACF,SAAS,OAAO;GACd,MAAM,IAAI,iBACR,mCAAmC,SAAS,IAAK,MAAgB,WACjE,YACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF;CACF;CAEA,MAAM,gBAAgB,UAAkB,OAA8B;EACpE,KAAK,kBAAkB;EAEvB,MAAM,sBAAM,IAAI,KAAK;EAErB,MAAM,KAAK,GAAG,OACZ,KAAK,WACL;GAAE,IAAI;GAAO,WAAW;EAAS,GACjC;GACE,QAAQ;GACR,YAAY,IAAI,YAAY;GAC5B,YAAY,IAAI,YAAY;EAC9B,CACF;EAGA,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA;GACA,WAAW;EACb,CAAC;CACH;CAEA,MAAM,eAA8C;EAElD,KAAK,OAAO;EAEZ,OAAO;GACL,OAAO,KAAK,UAAU;GACtB,aAAa,oBAAoB,KAAK,UAAU;GAChD,QAAQ;GACR,UAAU;GACV,cAAc,KAAK,UAAU;GAC7B,2BAAW,IAAI,KAAK;EACtB;CACF;CAEA,MAAM,gBACJ,WACA,cACkC;EAMlC,MAAM,IAAI,MACR,iHAEF;CACF;CAEA,MAAM,gBAAgB,UAAsD;EAC1E,KAAK,kBAAkB;EAEvB,MAAM,EAAE,SAAS,MAAM,KAAK,GAAG,MAC7B,kBAAkB,KAAK,UAAU,8CACjC,QACF;EAEA,OAAO,KAAK,KAAK,QAAiC,KAAK,YAAY,GAAG,CAAC;CACzE;;;;CAKA,YAAoB,KAAuD;EACzE,OAAO;GACL,OAAO,IAAI;GACX,UAAU,IAAI;GACd,YAAY,IAAI;GAChB,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,SAAS,IAAI;GACb,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,aAAa,IAAI,eACb,IAAI,KAAK,IAAI,YAAsB,IACnC,KAAA;GACJ,WAAW,IAAI,aACX,IAAI,KAAK,IAAI,UAAoB,IACjC,KAAA;EACN;CACF;AACF;;;;;;ACphBA,SAAgB,kBACd,MACoC;CACpC,OAAO,KAAK,SAAS;AACvB;;;;AAKA,SAAgB,gBACd,MACkC;CAClC,OAAO,KAAK,SAAS;AACvB;;;;AAKA,SAAgB,eACd,MACiC;CACjC,OAAO,KAAK,SAAS;AACvB;;;;AAKA,SAAgB,uBACd,MACyC;CACzC,OAAO,KAAK,SAAS;AACvB;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,eAAsB,eACpB,SACsB;CACtB,IAAI,kBAAkB,OAAO,GAAG;EAC9B,MAAM,EAAE,wBAAwB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,gBAAA;EAChC,MAAM,QAAQ,IAAI,oBAAoB,OAAO;EAC7C,MAAM,MAAM,WAAW;EACvB,OAAO;CACT;CAEA,IAAI,gBAAgB,OAAO,GAEzB,MAAM,IAAI,MACR,kEACF;CAGF,IAAI,eAAe,OAAO,GAExB,MAAM,IAAI,MACR,0EACF;CAGF,IAAI,uBAAuB,OAAO,GAEhC,MAAM,IAAI,MACR,0EACF;CAGF,MAAM,IAAI,MACR,kCAAmC,QAA6B,MAClE;AACF;;;;AClBA,IAAa,8BAA8B"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@happyvertical/secrets",
3
- "version": "0.80.0",
3
+ "version": "0.80.2",
4
4
  "description": "Envelope encryption for per-tenant secret management with pluggable backends",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -27,15 +27,15 @@
27
27
  "access": "public"
28
28
  },
29
29
  "dependencies": {
30
- "@happyvertical/sql": "0.80.0",
31
- "@happyvertical/utils": "0.80.0"
30
+ "@happyvertical/sql": "0.80.2",
31
+ "@happyvertical/utils": "0.80.2"
32
32
  },
33
33
  "devDependencies": {
34
34
  "@types/node": "25.0.10",
35
- "typescript": "^5.9.3",
36
- "vite": "7.3.2",
35
+ "typescript": "5.9.3",
36
+ "vite": "8.1.4",
37
37
  "vite-plugin-dts": "4.5.4",
38
- "vitest": "^4.1.5"
38
+ "vitest": "4.1.10"
39
39
  },
40
40
  "keywords": [
41
41
  "secrets",