@happyvertical/secrets 0.86.4 → 0.88.0

package/dist/shared/custody.d.ts

@@ -0,0 +1,264 @@
+import { KeyObject } from 'node:crypto';
+export type CredentialIssuanceMode = 'ephemeral' | 'durable';
+export type CustodyStage = 'issue' | 'store' | 'retrieve' | 'verify' | 'activate' | 'record' | 'inject' | 'revoke' | 'reconcile';
+export declare class CustodyError extends Error {
+    readonly code: string;
+    readonly stage: CustodyStage;
+    readonly details?: Readonly<Record<string, unknown>>;
+    constructor(code: string, stage: CustodyStage, message: string, options?: {
+        cause?: unknown;
+        details?: Record<string, unknown>;
+    });
+    toJSON(): Record<string, unknown>;
+}
+export declare class SecretMaterial {
+    #private;
+    private constructor();
+    static fromString(value: string): SecretMaterial;
+    get destroyed(): boolean;
+    use(operation: (value: string) => void | Promise<void>): Promise<void>;
+    destroy(): void;
+    toJSON(): string;
+    toString(): string;
+}
+export interface CredentialIssueRequest {
+    mode: CredentialIssuanceMode;
+    subject: string;
+    expiresAt?: string;
+    metadata?: Readonly<Record<string, string>>;
+}
+export interface IssuedCredential {
+    credentialId: string;
+    secret: SecretMaterial;
+    issuedAt?: string;
+    expiresAt?: string;
+}
+export interface CredentialIssuer {
+    readonly name: string;
+    issue(request: CredentialIssueRequest): Promise<IssuedCredential>;
+    /** Must be idempotent so failed custody transitions can be retried. */
+    revoke(credentialId: string, reason: string): Promise<void>;
+}
+export interface CredentialVerifier {
+    readonly name: string;
+    verify(input: {
+        credentialId: string;
+        secret: SecretMaterial;
+    }): Promise<{
+        verified: boolean;
+        verificationId?: string;
+    }>;
+}
+export interface SecretSinkRecord {
+    sinkName: string;
+    reference: string;
+    version: string;
+    storedAt: string;
+}
+export interface SecretSinkInventoryEntry extends SecretSinkRecord {
+    credentialId: string;
+}
+export interface CredentialSecretSink {
+    readonly name: string;
+    store(input: {
+        credentialId: string;
+        secret: SecretMaterial;
+        metadata: Readonly<Record<string, string>>;
+    }): Promise<SecretSinkRecord>;
+    retrieve(record: SecretSinkRecord): Promise<SecretMaterial>;
+    /**
+     * Removes any write for this credential, including a store that persisted
+     * data but failed before returning its record. Must be idempotent.
+     */
+    removeByCredentialId(credentialId: string, reason: string): Promise<void>;
+    /** Must conditionally remove this exact version and be idempotent. */
+    remove(record: SecretSinkRecord, reason: string): Promise<void>;
+    inventory(): Promise<SecretSinkInventoryEntry[]>;
+}
+export interface CustodyAttribution {
+    actor: string;
+    runtime: string;
+    session: string;
+}
+export interface CustodyReceipt {
+    receiptId: string;
+    mode: CredentialIssuanceMode;
+    credentialId: string;
+    subject: string;
+    issuer: string;
+    verifier: string;
+    verificationId?: string;
+    verificationState: 'verified';
+    issuedAt: string;
+    verifiedAt: string;
+    expiresAt?: string;
+    sink?: SecretSinkRecord;
+    replacesReceiptId?: string;
+    rotationRootReceiptId: string;
+    attribution: CustodyAttribution;
+    metadata: Readonly<Record<string, string>>;
+    finalizer: string;
+    finalizationId: string;
+    attestation: CustodyReceiptAttestation;
+}
+export interface CustodyReceiptAttestation {
+    algorithm: 'Ed25519';
+    attestor: string;
+    keyId: string;
+    signature: string;
+}
+export interface CredentialReceiptAttestor {
+    readonly name: string;
+    readonly keyId: string;
+    attest(payload: string): Promise<string>;
+}
+export interface CredentialCustodyFinalizer {
+    readonly name: string;
+    prepare(input: {
+        receipt: CustodyReceipt;
+        secret: SecretMaterial;
+    }): Promise<{
+        prepared: boolean;
+    }>;
+    commit(input: {
+        receipt: CustodyReceipt;
+    }): Promise<void>;
+    abort(input: {
+        receipt: CustodyReceipt;
+        reason: string;
+    }): Promise<void>;
+    status(input: {
+        receipt: CustodyReceipt;
+    }): Promise<'missing' | 'prepared' | 'committed' | 'aborted'>;
+}
+export declare class Ed25519CustodyReceiptAttestor implements CredentialReceiptAttestor {
+    #private;
+    readonly name: string;
+    readonly keyId: string;
+    constructor(options: {
+        privateKey: KeyObject;
+        keyId: string;
+        name?: string;
+    });
+    attest(payload: string): Promise<string>;
+}
+export type CustodyEventType = 'issued' | 'revoked' | 'expired' | 'replaced' | 'rollback-pending' | 'rollback-complete' | 'finalization-pending' | 'retirement-pending' | 'retirement-complete' | 'orphan-detected' | 'orphan-removed';
+export interface CustodyEvent {
+    eventId: string;
+    type: CustodyEventType;
+    occurredAt: string;
+    receiptId?: string;
+    recoveryId?: string;
+    credentialId?: string;
+    requiresSink?: boolean;
+    finalizationReceipt?: CustodyReceipt;
+    recoveryReceipt?: CustodyReceipt;
+    replacementReceiptId?: string;
+    sinkReference?: string;
+    reason?: string;
+}
+export interface CustodyLedger {
+    /**
+     * Atomically records a receipt and its finalization-pending event.
+     * Implementations must reject duplicate receipt IDs, terminal predecessors,
+     * a second child for the same replacesReceiptId, and any other event type.
+     */
+    recordIssuance(receipt: CustodyReceipt, event: CustodyEvent): Promise<void>;
+    /**
+     * Idempotently appends the issued event and optional retirement-pending
+     * followup in one transaction. No other event types are accepted.
+     */
+    commitIssuance(receiptId: string, event: CustodyEvent, followup?: CustodyEvent): Promise<void>;
+    /**
+     * Idempotently appends an event by eventId. Replaying the same event must
+     * succeed; reusing an eventId for different content must fail closed.
+     */
+    appendEvent(event: CustodyEvent): Promise<void>;
+    listReceipts(): Promise<CustodyReceipt[]>;
+    listEvents(): Promise<CustodyEvent[]>;
+}
+export declare class InMemoryCustodyLedger implements CustodyLedger {
+    #private;
+    recordIssuance(receipt: CustodyReceipt, event: CustodyEvent): Promise<void>;
+    appendEvent(event: CustodyEvent): Promise<void>;
+    commitIssuance(receiptId: string, event: CustodyEvent, followup?: CustodyEvent): Promise<void>;
+    listReceipts(): Promise<CustodyReceipt[]>;
+    listEvents(): Promise<CustodyEvent[]>;
+}
+export interface CredentialLease {
+    readonly receipt: CustodyReceipt;
+    withEnvironment(variableName: string, operation: () => void | Promise<void>): Promise<void>;
+    withChildProcess(options: CredentialChildProcessOptions): Promise<CredentialChildProcessResult>;
+    revoke(reason?: string): Promise<void>;
+}
+export interface CredentialChildProcessOptions {
+    /**
+     * Acknowledges that the command and every credential-bearing descendant are
+     * trusted to remain in the SDK-owned POSIX process group.
+     */
+    trust: 'cooperative-process-group';
+    command: string;
+    args?: readonly string[];
+    environmentVariable: string;
+    environment?: Readonly<Record<string, string>>;
+    cwd?: string;
+    timeoutMs?: number;
+    maxOutputBytes?: number;
+}
+export interface CredentialChildProcessResult {
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+export interface CustodyReconciliation {
+    checkedAt: string;
+    orphaned: SecretSinkInventoryEntry[];
+    missing: CustodyReceipt[];
+}
+export interface CredentialCustodyOptions {
+    issuer: CredentialIssuer;
+    verifier: CredentialVerifier;
+    ledger: CustodyLedger;
+    attestor: CredentialReceiptAttestor;
+    finalizer: CredentialCustodyFinalizer;
+    sink?: CredentialSecretSink;
+    ephemeralTtlMs?: number;
+    ephemeralRevokeRetryMs?: number;
+    orphanGraceMs?: number;
+    finalizationTakeoverMs?: number;
+    now?: () => Date;
+    onBackgroundError?: (error: CustodyError) => void;
+}
+export interface CustodyIssuanceRequest {
+    mode: CredentialIssuanceMode;
+    subject: string;
+    attribution: CustodyAttribution;
+    expiresAt?: string;
+    metadata?: Readonly<Record<string, string>>;
+    replacesReceiptId?: string;
+}
+export declare class CredentialCustody {
+    #private;
+    constructor(options: CredentialCustodyOptions);
+    issue(request: CustodyIssuanceRequest): Promise<CredentialLease>;
+    rotate(receiptId: string, request: Omit<CustodyIssuanceRequest, 'mode' | 'replacesReceiptId'>): Promise<CredentialLease>;
+    revoke(receiptId: string, reason?: string): Promise<void>;
+    recoverPendingRollbacks(): Promise<void>;
+    recoverCredential(credentialId: string, options?: {
+        requiresSink?: boolean;
+    }): Promise<void>;
+    reconcile(): Promise<CustodyReconciliation>;
+    recoverOrphans(report: CustodyReconciliation): Promise<void>;
+}
+export declare function withEnvironmentSecret(material: SecretMaterial, variableName: string, operation: () => void | Promise<void>, bounds?: {
+    expiresAt?: string;
+}): Promise<void>;
+export declare function runCredentialChildProcess(material: SecretMaterial, options: CredentialChildProcessOptions, bounds?: {
+    expiresAt?: string;
+}): Promise<CredentialChildProcessResult>;
+export declare function verifyCustodyReceiptAttestation(receipt: CustodyReceipt, material: SecretMaterial, publicKey: KeyObject): Promise<boolean>;
+export declare function redactCredentialText(input: string, knownSecrets?: readonly string[]): string;
+export declare function redactCredentialValues(value: unknown, knownSecrets?: readonly string[]): unknown;
+//# sourceMappingURL=custody.d.ts.map

package/dist/shared/custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../src/shared/custody.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,SAAS,EAIf,MAAM,aAAa,CAAC;AAsDrB,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,CAAC;AAC7D,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,WAAW,CAAC;AAEhB,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBAGnD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;IAgBlE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASlC;AAED,qBAAa,cAAc;;IAIzB,OAAO;IAIP,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IAWhD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAEK,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC5E,OAAO,IAAI,IAAI;IAKf,MAAM,IAAI,MAAM;IAIhB,QAAQ,IAAI,MAAM;CAOnB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClE,uEAAuE;IACvE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,KAAK,EAAE;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,cAAc,CAAC;KACxB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAyB,SAAQ,gBAAgB;IAChE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,KAAK,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,cAAc,CAAC;QACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC5C,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D;;;OAGG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,SAAS,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,yBAAyB,CAAC;CACxC;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,EAAE,cAAc,CAAC;KACxB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,EAAE,cAAc,CAAC;KACzB,GAAG,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;CAC/D;AAED,qBAAa,6BACX,YAAW,yBAAyB;;IAEpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAGX,OAAO,EAAE;QACnB,UAAU,EAAE,SAAS,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;IAkBK,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAK/C;AAED,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,SAAS,GACT,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,iBAAiB,GACjB,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,cAAc,CAAC;IACrC,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;OAGG;IACH,cAAc,CACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,YAAY,EACnB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1C,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CACvC;AAED,qBAAa,qBAAsB,YAAW,aAAa;;IAInD,cAAc,CAClB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC;IAuDV,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAe/C,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,YAAY,EACnB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,IAAI,CAAC;IA4BV,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIzC,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;CAG5C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,gBAAgB,CACd,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,SAAS,EAAE,0BAA0B,CAAC;IACtC,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;CACnD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,kBAAkB,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,iBAAiB;;gBAgBhB,OAAO,EAAE,wBAAwB;IAuCvC,KAAK,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC;IAwWhE,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,mBAAmB,CAAC,GAClE,OAAO,CAAC,eAAe,CAAC;IAgBrB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IAgQxC,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,IAAI,CAAC;IAUV,SAAS,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAqE3C,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CA6mBnE;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACrC,MAAM,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,6BAA6B,EACtC,MAAM,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA6LvC;AAED,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC,CA+BlB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,MAAM,CASR;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,OAAO,CAiBT"}

package/dist/shared/factory.d.ts

@@ -34,7 +34,7 @@ export declare function isAzureKeyVaultOptions(opts: GetSecretStoreOptions): opt
  * });
  *
  * // Encrypt a secret
- * const envelope = await store.encrypt('tenant-123', 'api-key', 'sk_live_xxx');
+ * const envelope = await store.encrypt('tenant-123', 'api-key', 'synthetic-secret');
  *
  * // Decrypt
  * const decrypted = await store.decrypt('tenant-123', envelope);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/secrets",
-  "version": "0.86.4",
+  "version": "0.88.0",
   "description": "Envelope encryption for per-tenant secret management with pluggable backends",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,8 +27,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@happyvertical/sql": "0.86.4",
-    "@happyvertical/utils": "0.86.4"
+    "@happyvertical/sql": "0.88.0",
+    "@happyvertical/utils": "0.88.0"
   },
   "devDependencies": {
     "@types/node": "25.0.10",

package/LICENSE

@@ -1,7 +0,0 @@
-Copyright <2025> <Happy Vertical Corporation>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.