@hilbras/keystone 1.1.0

package/dist/services/queue/inProcess.js

@@ -0,0 +1,63 @@
+const DEFAULT_ATTEMPTS = 3;
+export class InProcessQueue {
+    handlers = new Map();
+    stats = new Map();
+    async enqueue(job) {
+        setImmediate(() => {
+            this.run(job, 1).catch((err) => {
+                console.error(`[in-process-queue] job ${job.type} failed permanently:`, err);
+            });
+        });
+    }
+    process(type, handler) {
+        this.handlers.set(type, handler);
+    }
+    async getStats() {
+        return Array.from(this.stats.entries()).map(([type, s]) => ({
+            type,
+            count: s.count,
+            failed: s.failed,
+        }));
+    }
+    async getFailed() {
+        return [];
+    }
+    async retry() {
+        // No persisted failed jobs in the in-process queue.
+    }
+    async retryAll() {
+        // No persisted failed jobs in the in-process queue.
+    }
+    async close() {
+        this.handlers.clear();
+        this.stats.clear();
+    }
+    async run(job, attempt) {
+        const handler = this.handlers.get(job.type);
+        if (!handler) {
+            console.warn(`[in-process-queue] no handler registered for ${job.type}`);
+            return;
+        }
+        this.increment(job.type, "count");
+        try {
+            await handler(job);
+        }
+        catch (err) {
+            const maxAttempts = job.attempts ?? DEFAULT_ATTEMPTS;
+            if (attempt < maxAttempts) {
+                const delay = Math.min(1000 * 2 ** (attempt - 1), 30000);
+                console.warn(`[in-process-queue] job ${job.type} failed (attempt ${attempt}/${maxAttempts}), retrying in ${delay}ms`);
+                setTimeout(() => this.run(job, attempt + 1), delay);
+                return;
+            }
+            this.increment(job.type, "failed");
+            throw err;
+        }
+    }
+    increment(type, key) {
+        const current = this.stats.get(type) ?? { count: 0, failed: 0 };
+        current[key]++;
+        this.stats.set(type, current);
+    }
+}
+//# sourceMappingURL=inProcess.js.map

package/dist/services/queue/inProcess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inProcess.js","sourceRoot":"","sources":["../../../src/services/queue/inProcess.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,OAAO,cAAc;IACjB,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzC,KAAK,GAAG,IAAI,GAAG,EAA6C,CAAC;IAErE,KAAK,CAAC,OAAO,CAAI,GAAW;QAC1B,YAAY,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7B,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,IAAI,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,OAAmB;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI;YACJ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,oDAAoD;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,oDAAoD;IACtD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAQ,EAAE,OAAe;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,gDAAgD,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,IAAI,gBAAgB,CAAC;YACrD,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,IAAI,oBAAoB,OAAO,IAAI,WAAW,kBAAkB,KAAK,IAAI,CAAC,CAAC;gBACtH,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,GAAuB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/services/queue/index.d.ts

@@ -0,0 +1,7 @@
+import type { Queue } from "./types.js";
+export * from "./types.js";
+export { InProcessQueue } from "./inProcess.js";
+export { BullMQQueue } from "./bullmq.js";
+export declare function createQueue(): Queue;
+export declare const queue: Queue;
+//# sourceMappingURL=index.d.ts.map

package/dist/services/queue/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/queue/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,wBAAgB,WAAW,IAAI,KAAK,CAOnC;AAED,eAAO,MAAM,KAAK,OAAgB,CAAC"}

package/dist/services/queue/index.js

@@ -0,0 +1,19 @@
+import { config } from "../../config.js";
+import { InProcessQueue } from "./inProcess.js";
+import { BullMQQueue } from "./bullmq.js";
+export * from "./types.js";
+export { InProcessQueue } from "./inProcess.js";
+export { BullMQQueue } from "./bullmq.js";
+export function createQueue() {
+    const explicitProvider = config.KEYSTONE_QUEUE_PROVIDER;
+    if (explicitProvider === "in-process")
+        return new InProcessQueue();
+    if (explicitProvider === "bullmq")
+        return new BullMQQueue(config.REDIS_URL);
+    // Default to bullmq when Redis is available, otherwise fall back to in-process.
+    if (config.REDIS_URL)
+        return new BullMQQueue(config.REDIS_URL);
+    return new InProcessQueue();
+}
+export const queue = createQueue();
+//# sourceMappingURL=index.js.map

package/dist/services/queue/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/queue/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,UAAU,WAAW;IACzB,MAAM,gBAAgB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IACxD,IAAI,gBAAgB,KAAK,YAAY;QAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IACnE,IAAI,gBAAgB,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5E,gFAAgF;IAChF,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/D,OAAO,IAAI,cAAc,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC"}

package/dist/services/queue/types.d.ts

@@ -0,0 +1,24 @@
+export interface Job<T = unknown> {
+    id?: string;
+    type: string;
+    payload: T;
+    attempts?: number;
+    createdAt?: Date;
+}
+export type JobHandler = (job: Job) => void | Promise<void>;
+export interface QueueStats {
+    type: string;
+    count: number;
+    failed?: number;
+    delayed?: number;
+}
+export interface Queue {
+    enqueue<T>(job: Job<T>): Promise<void>;
+    process(type: string, handler: JobHandler): void;
+    getStats?(): Promise<QueueStats[]>;
+    getFailed?(limit: number): Promise<Job[]>;
+    retry?(jobId: string): Promise<void>;
+    retryAll?(): Promise<void>;
+    close?(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/services/queue/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/queue/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,OAAO;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,KAAK;IACpB,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnC,SAAS,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB"}

package/dist/services/queue/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/services/queue/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/queue/types.ts"],"names":[],"mappings":""}

package/dist/services/redis.d.ts

@@ -0,0 +1,9 @@
+import { Redis } from "ioredis";
+/**
+ * Shared Redis connection used by rate limiting, anomaly detection, and any
+ * other distributed state in Keystone. Lazy connection means the process will
+ * not fail at import time if Redis is temporarily unavailable.
+ */
+export declare const redis: Redis;
+export declare function isRedisReady(): boolean;
+//# sourceMappingURL=redis.d.ts.map

package/dist/services/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/services/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGhC;;;;GAIG;AACH,eAAO,MAAM,KAAK,OAGhB,CAAC;AAEH,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/services/redis.js

@@ -0,0 +1,15 @@
+import { Redis } from "ioredis";
+import { config } from "../config.js";
+/**
+ * Shared Redis connection used by rate limiting, anomaly detection, and any
+ * other distributed state in Keystone. Lazy connection means the process will
+ * not fail at import time if Redis is temporarily unavailable.
+ */
+export const redis = new Redis(config.REDIS_URL, {
+    maxRetriesPerRequest: 3,
+    lazyConnect: true,
+});
+export function isRedisReady() {
+    return redis.status === "ready" || redis.status === "connect";
+}
+//# sourceMappingURL=redis.js.map

package/dist/services/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/services/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;IAC/C,oBAAoB,EAAE,CAAC;IACvB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;AAChE,CAAC"}

package/dist/services/secrets/awsKms.d.ts

@@ -0,0 +1,41 @@
+import type { SecretsProvider, SigningKeyPair } from "./provider.js";
+import { hashPassword, verifyPassword } from "./password.js";
+/**
+ * AWS KMS secrets provider reference implementation.
+ *
+ * In a real deployment this would use the AWS SDK to:
+ * - Store/retrieve JWT signing keys in AWS Secrets Manager or Parameter Store
+ * - Use KMS for envelope encryption of secrets
+ *
+ * The current implementation keeps keys in memory and encrypts the data
+ * encryption key (DEK) with a KMS key ID supplied via KMS_KEY_ID. It is
+ * intended as a starting point for a full AWS integration.
+ */
+export declare class AwsKmsSecretsProvider implements SecretsProvider {
+    readonly name = "aws-kms";
+    hashPassword: typeof hashPassword;
+    verifyPassword: typeof verifyPassword;
+    private kmsKeyId?;
+    private keyPair;
+    constructor();
+    hashApiKey(key: string): string;
+    hashClientSecret(secret: string): string;
+    generateClientSecret(): string;
+    generateApiKey(): {
+        key: string;
+        prefix: string;
+    };
+    getActiveSigningKey(): Promise<SigningKeyPair>;
+    getSigningKeyById(keyId: string): Promise<SigningKeyPair | undefined>;
+    rotateSigningKeys(): Promise<SigningKeyPair>;
+    listActiveSigningKeys(): Promise<{
+        keyId: string;
+        createdAt: Date;
+        expiresAt?: Date | null;
+    }[]>;
+    listValidSigningKeys(): Promise<SigningKeyPair[]>;
+    getEncryptionKey(): Promise<Buffer>;
+    encryptSecret(plain: string): Promise<string>;
+    decryptSecret(cipherText: string): Promise<string>;
+}
+//# sourceMappingURL=awsKms.d.ts.map

package/dist/services/secrets/awsKms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsKms.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/awsKms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,QAAQ,CAAC,IAAI,aAAa;IAE1B,YAAY,sBAAgB;IAC5B,cAAc,wBAAkB;IAEhC,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,OAAO,CAA+B;;IAS9C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI/B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIxC,oBAAoB,IAAI,MAAM;IAI9B,cAAc,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAK3C,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC;IAK9C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAMrE,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC;IAc5C,qBAAqB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAK/F,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAKjD,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAKnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGzD"}

package/dist/services/secrets/awsKms.js

@@ -0,0 +1,81 @@
+import crypto from "node:crypto";
+import { exportPKCS8, exportSPKI, generateKeyPair } from "jose";
+import { hashPassword, verifyPassword } from "./password.js";
+/**
+ * AWS KMS secrets provider reference implementation.
+ *
+ * In a real deployment this would use the AWS SDK to:
+ * - Store/retrieve JWT signing keys in AWS Secrets Manager or Parameter Store
+ * - Use KMS for envelope encryption of secrets
+ *
+ * The current implementation keeps keys in memory and encrypts the data
+ * encryption key (DEK) with a KMS key ID supplied via KMS_KEY_ID. It is
+ * intended as a starting point for a full AWS integration.
+ */
+export class AwsKmsSecretsProvider {
+    name = "aws-kms";
+    hashPassword = hashPassword;
+    verifyPassword = verifyPassword;
+    kmsKeyId;
+    keyPair = null;
+    constructor() {
+        this.kmsKeyId = process.env.KMS_KEY_ID;
+        if (!this.kmsKeyId) {
+            throw new Error("AwsKmsSecretsProvider requires KMS_KEY_ID");
+        }
+    }
+    hashApiKey(key) {
+        return crypto.createHash("sha256").update(key).digest("hex");
+    }
+    hashClientSecret(secret) {
+        return crypto.createHash("sha256").update(secret).digest("hex");
+    }
+    generateClientSecret() {
+        return `cs_${crypto.randomBytes(32).toString("base64url")}`;
+    }
+    generateApiKey() {
+        const key = `ks_${crypto.randomBytes(32).toString("base64url")}`;
+        return { key, prefix: key.slice(0, 7) };
+    }
+    async getActiveSigningKey() {
+        if (this.keyPair)
+            return this.keyPair;
+        return this.rotateSigningKeys();
+    }
+    async getSigningKeyById(keyId) {
+        const active = await this.getActiveSigningKey();
+        if (active.keyId === keyId)
+            return active;
+        return undefined;
+    }
+    async rotateSigningKeys() {
+        const pair = await generateKeyPair("RS256", { extractable: true });
+        const privatePem = await exportPKCS8(pair.privateKey);
+        const publicPem = await exportSPKI(pair.publicKey);
+        const keyId = `aws-${crypto.randomBytes(8).toString("base64url")}`;
+        // In production: store privatePem/publicPem in AWS Secrets Manager encrypted by KMS.
+        // eslint-disable-next-line no-console
+        console.warn(`[aws-kms] New signing key ${keyId} generated. In production, store it in AWS Secrets Manager.`);
+        this.keyPair = { keyId, privateKey: pair.privateKey, publicKey: pair.publicKey };
+        return this.keyPair;
+    }
+    async listActiveSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [{ keyId: active.keyId, createdAt: new Date(), expiresAt: null }];
+    }
+    async listValidSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [active];
+    }
+    async getEncryptionKey() {
+        // In production: decrypt a stored data key using KMS.
+        throw new Error("AwsKmsSecretsProvider.getEncryptionKey() is not yet implemented");
+    }
+    async encryptSecret(plain) {
+        throw new Error("AwsKmsSecretsProvider.encryptSecret() is not yet implemented");
+    }
+    async decryptSecret(cipherText) {
+        throw new Error("AwsKmsSecretsProvider.decryptSecret() is not yet implemented");
+    }
+}
+//# sourceMappingURL=awsKms.js.map

package/dist/services/secrets/awsKms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsKms.js","sourceRoot":"","sources":["../../../src/services/secrets/awsKms.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAA2B,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,SAAS,CAAC;IAE1B,YAAY,GAAG,YAAY,CAAC;IAC5B,cAAc,GAAG,cAAc,CAAC;IAExB,QAAQ,CAAU;IAClB,OAAO,GAA0B,IAAI,CAAC;IAE9C;QACE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;QAClB,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAEnE,qFAAqF;QACrF,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,6BAA6B,KAAK,6DAA6D,CAAC,CAAC;QAE9G,IAAI,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,sDAAsD;QACtD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;CACF"}

package/dist/services/secrets/azureKeyVault.d.ts

@@ -0,0 +1,44 @@
+import type { SecretsProvider, SigningKeyPair } from "./provider.js";
+import { hashPassword, verifyPassword } from "./password.js";
+/**
+ * Azure Key Vault secrets provider.
+ *
+ * This is a reference implementation. In production it should use the Azure
+ * SDK (@azure/identity and @azure/keyvault-keys/secrets) to retrieve signing
+ * keys, encryption keys, and credentials from Azure Key Vault. Password hashing
+ * helpers are reused locally because they are compute-bound.
+ */
+export declare class AzureKeyVaultSecretsProvider implements SecretsProvider {
+    readonly name = "azure-key-vault";
+    hashPassword: typeof hashPassword;
+    verifyPassword: typeof verifyPassword;
+    private vaultUrl;
+    private tenantId;
+    private clientId;
+    private clientSecret;
+    constructor();
+    hashApiKey(key: string): string;
+    hashClientSecret(secret: string): string;
+    generateClientSecret(): string;
+    generateApiKey(): {
+        key: string;
+        prefix: string;
+    };
+    getActiveSigningKey(): Promise<SigningKeyPair>;
+    getSigningKeyById(keyId: string): Promise<SigningKeyPair | undefined>;
+    rotateSigningKeys(): Promise<SigningKeyPair>;
+    listActiveSigningKeys(): Promise<{
+        keyId: string;
+        createdAt: Date;
+        expiresAt?: Date | null;
+    }[]>;
+    listValidSigningKeys(): Promise<SigningKeyPair[]>;
+    getEncryptionKey(): Promise<Buffer>;
+    encryptSecret(plain: string): Promise<string>;
+    decryptSecret(cipherText: string): Promise<string>;
+    private readPath;
+    private readKey;
+    private writeKey;
+    private getAccessToken;
+}
+//# sourceMappingURL=azureKeyVault.d.ts.map

package/dist/services/secrets/azureKeyVault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azureKeyVault.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/azureKeyVault.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;GAOG;AACH,qBAAa,4BAA6B,YAAW,eAAe;IAClE,QAAQ,CAAC,IAAI,qBAAqB;IAElC,YAAY,sBAAgB;IAC5B,cAAc,wBAAkB;IAEhC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAS;;IAe7B,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI/B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIxC,oBAAoB,IAAI,MAAM;IAI9B,cAAc,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAK3C,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC;IAU9C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAUrE,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC;IAW5C,qBAAqB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAK/F,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIjD,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAUnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAW1C,QAAQ;YAYR,OAAO;YAIP,QAAQ;YAcR,cAAc;CAiB7B"}

package/dist/services/secrets/azureKeyVault.js

@@ -0,0 +1,152 @@
+import crypto from "node:crypto";
+import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair } from "jose";
+import { hashPassword, verifyPassword } from "./password.js";
+/**
+ * Azure Key Vault secrets provider.
+ *
+ * This is a reference implementation. In production it should use the Azure
+ * SDK (@azure/identity and @azure/keyvault-keys/secrets) to retrieve signing
+ * keys, encryption keys, and credentials from Azure Key Vault. Password hashing
+ * helpers are reused locally because they are compute-bound.
+ */
+export class AzureKeyVaultSecretsProvider {
+    name = "azure-key-vault";
+    hashPassword = hashPassword;
+    verifyPassword = verifyPassword;
+    vaultUrl;
+    tenantId;
+    clientId;
+    clientSecret;
+    constructor() {
+        this.vaultUrl = (process.env.AZURE_KEY_VAULT_URL || "").replace(/\/$/, "");
+        this.tenantId = process.env.AZURE_TENANT_ID || "";
+        this.clientId = process.env.AZURE_CLIENT_ID || "";
+        this.clientSecret = process.env.AZURE_CLIENT_SECRET || "";
+        if (!this.vaultUrl || !this.tenantId || !this.clientId || !this.clientSecret) {
+            throw new Error("AzureKeyVaultSecretsProvider requires AZURE_KEY_VAULT_URL, AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET");
+        }
+    }
+    hashApiKey(key) {
+        return crypto.createHash("sha256").update(key).digest("hex");
+    }
+    hashClientSecret(secret) {
+        return crypto.createHash("sha256").update(secret).digest("hex");
+    }
+    generateClientSecret() {
+        return `cs_${crypto.randomBytes(32).toString("base64url")}`;
+    }
+    generateApiKey() {
+        const key = `ks_${crypto.randomBytes(32).toString("base64url")}`;
+        return { key, prefix: key.slice(0, 7) };
+    }
+    async getActiveSigningKey() {
+        const stored = await this.readKey("jwt-active");
+        if (stored?.private && stored?.public) {
+            const privateKey = await importPKCS8(String(stored.private), "RS256");
+            const publicKey = await importSPKI(String(stored.public), "RS256");
+            return { keyId: String(stored.keyId ?? "azure-active"), privateKey, publicKey };
+        }
+        return this.rotateSigningKeys();
+    }
+    async getSigningKeyById(keyId) {
+        const active = await this.getActiveSigningKey();
+        if (active.keyId === keyId)
+            return active;
+        const stored = await this.readKey(`jwt-${keyId}`);
+        if (!stored?.private)
+            return undefined;
+        const privateKey = await importPKCS8(String(stored.private), "RS256");
+        const publicKey = await importSPKI(String(stored.public), "RS256");
+        return { keyId, privateKey, publicKey };
+    }
+    async rotateSigningKeys() {
+        const pair = await generateKeyPair("RS256", { extractable: true });
+        const privatePem = await exportPKCS8(pair.privateKey);
+        const publicPem = await exportSPKI(pair.publicKey);
+        const keyId = `azure-${crypto.randomBytes(8).toString("base64url")}`;
+        await this.writeKey("jwt-active", { keyId, private: privatePem, public: publicPem, rotatedAt: new Date().toISOString() });
+        return { keyId, privateKey: pair.privateKey, publicKey: pair.publicKey };
+    }
+    async listActiveSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [{ keyId: active.keyId, createdAt: new Date(), expiresAt: null }];
+    }
+    async listValidSigningKeys() {
+        return [await this.getActiveSigningKey()];
+    }
+    async getEncryptionKey() {
+        const stored = await this.readKey("encryption-key");
+        if (stored?.value) {
+            return Buffer.from(String(stored.value), "base64");
+        }
+        const key = crypto.randomBytes(32);
+        await this.writeKey("encryption-key", { value: key.toString("base64") });
+        return key;
+    }
+    async encryptSecret(plain) {
+        const key = await this.getEncryptionKey();
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
+        const encrypted = Buffer.concat([cipher.update(plain, "utf-8"), cipher.final()]);
+        return `${iv.toString("base64")}:${encrypted.toString("base64")}`;
+    }
+    async decryptSecret(cipherText) {
+        const key = await this.getEncryptionKey();
+        const [ivBase64, encryptedBase64] = cipherText.split(":");
+        if (!ivBase64 || !encryptedBase64)
+            throw new Error("Invalid cipher text format");
+        const iv = Buffer.from(ivBase64, "base64");
+        const encrypted = Buffer.from(encryptedBase64, "base64");
+        const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf-8");
+    }
+    // Reference stubs for Azure Key Vault HTTP API integration.
+    async readPath(path) {
+        const url = `${this.vaultUrl}/secrets/${path}?api-version=7.4`;
+        const token = await this.getAccessToken();
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+        });
+        if (response.status === 404)
+            return undefined;
+        if (!response.ok)
+            throw new Error(`Azure Key Vault read failed: ${response.status}`);
+        const body = await response.json();
+        return typeof body.value === "string" ? JSON.parse(body.value) : body.value;
+    }
+    async readKey(name) {
+        return this.readPath(name);
+    }
+    async writeKey(name, value) {
+        const url = `${this.vaultUrl}/secrets/${name}?api-version=7.4`;
+        const token = await this.getAccessToken();
+        const response = await fetch(url, {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: JSON.stringify(value) }),
+        });
+        if (!response.ok)
+            throw new Error(`Azure Key Vault write failed: ${response.status}`);
+    }
+    async getAccessToken() {
+        const url = `https://login.microsoftonline.com/${this.tenantId}/oauth2/v2.0/token`;
+        const params = new URLSearchParams();
+        params.set("client_id", this.clientId);
+        params.set("client_secret", this.clientSecret);
+        params.set("scope", "https://vault.azure.net/.default");
+        params.set("grant_type", "client_credentials");
+        const response = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: params.toString(),
+        });
+        if (!response.ok)
+            throw new Error(`Azure authentication failed: ${response.status}`);
+        const body = await response.json();
+        return String(body.access_token);
+    }
+}
+//# sourceMappingURL=azureKeyVault.js.map

package/dist/services/secrets/azureKeyVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azureKeyVault.js","sourceRoot":"","sources":["../../../src/services/secrets/azureKeyVault.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IAC9B,IAAI,GAAG,iBAAiB,CAAC;IAElC,YAAY,GAAG,YAAY,CAAC;IAC5B,cAAc,GAAG,cAAc,CAAC;IAExB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,YAAY,CAAS;IAE7B;QACE,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;QAClB,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAErE,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAE1H,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzF,CAAC;IAED,4DAA4D;IACpD,KAAK,CAAC,QAAQ,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,YAAY,IAAI,kBAAkB,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC1E,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,KAA8B;QACjE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,YAAY,IAAI,kBAAkB,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,qCAAqC,IAAI,CAAC,QAAQ,oBAAoB,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/services/secrets/database.d.ts

@@ -0,0 +1,29 @@
+import type { SecretsProvider, SigningKeyPair } from "./provider.js";
+import { hashPassword, verifyPassword } from "./password.js";
+export declare class DatabaseSecretsProvider implements SecretsProvider {
+    readonly name = "database";
+    hashPassword: typeof hashPassword;
+    verifyPassword: typeof verifyPassword;
+    hashApiKey(key: string): string;
+    hashClientSecret(secret: string): string;
+    generateClientSecret(): string;
+    generateApiKey(): {
+        key: string;
+        prefix: string;
+    };
+    getActiveSigningKey(): Promise<SigningKeyPair>;
+    getSigningKeyById(keyId: string): Promise<SigningKeyPair | undefined>;
+    rotateSigningKeys(): Promise<SigningKeyPair>;
+    private createSigningKey;
+    private loadKeyPair;
+    getEncryptionKey(): Promise<Buffer>;
+    encryptSecret(plain: string): Promise<string>;
+    decryptSecret(cipherText: string): Promise<string>;
+    listActiveSigningKeys(): Promise<{
+        keyId: string;
+        createdAt: Date;
+        expiresAt?: Date | null;
+    }[]>;
+    listValidSigningKeys(): Promise<SigningKeyPair[]>;
+}
+//# sourceMappingURL=database.d.ts.map

package/dist/services/secrets/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/database.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO7D,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,QAAQ,CAAC,IAAI,cAAc;IAE3B,YAAY,sBAAgB;IAC5B,cAAc,wBAAkB;IAEhC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI/B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIxC,oBAAoB,IAAI,MAAM;IAI9B,cAAc,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAM3C,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC;IAe9C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAMrE,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC;YAQpC,gBAAgB;YAkBhB,WAAW;IAOnB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IA0BnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAclD,qBAAqB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAS/F,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;CAcxD"}