@hilbras/keystone 1.1.0

package/dist/services/secrets/database.js

@@ -0,0 +1,138 @@
+import crypto from "node:crypto";
+import { eq, and, or, gt, isNull } from "drizzle-orm";
+import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair } from "jose";
+import { db } from "../../db/index.js";
+import { secrets } from "../../db/schema.js";
+import { config } from "../../config.js";
+import { hashPassword, verifyPassword } from "./password.js";
+const ENCRYPTION_ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 16;
+const AUTH_TAG_LENGTH = 16;
+const KEY_ID_BYTES = 8;
+export class DatabaseSecretsProvider {
+    name = "database";
+    hashPassword = hashPassword;
+    verifyPassword = verifyPassword;
+    hashApiKey(key) {
+        return crypto.createHash("sha256").update(key).digest("hex");
+    }
+    hashClientSecret(secret) {
+        return crypto.createHash("sha256").update(secret).digest("hex");
+    }
+    generateClientSecret() {
+        return `cs_${crypto.randomBytes(32).toString("base64url")}`;
+    }
+    generateApiKey() {
+        const key = `ks_${crypto.randomBytes(32).toString("base64url")}`;
+        const prefix = key.slice(0, 7);
+        return { key, prefix };
+    }
+    async getActiveSigningKey() {
+        const [active] = await db
+            .select()
+            .from(secrets)
+            .where(and(eq(secrets.type, "jwt_signing"), eq(secrets.isActive, true), isNull(secrets.expiresAt)))
+            .orderBy(secrets.createdAt)
+            .limit(1);
+        if (active) {
+            return this.loadKeyPair(active);
+        }
+        return this.createSigningKey();
+    }
+    async getSigningKeyById(keyId) {
+        const [record] = await db.select().from(secrets).where(eq(secrets.keyId, keyId)).limit(1);
+        if (!record || record.type !== "jwt_signing")
+            return undefined;
+        return this.loadKeyPair(record);
+    }
+    async rotateSigningKeys() {
+        await db
+            .update(secrets)
+            .set({ isActive: false, expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) })
+            .where(eq(secrets.type, "jwt_signing"));
+        return this.createSigningKey();
+    }
+    async createSigningKey() {
+        const pair = await generateKeyPair("RS256", { extractable: true });
+        const privatePem = await exportPKCS8(pair.privateKey);
+        const publicPem = await exportSPKI(pair.publicKey);
+        const keyId = crypto.randomBytes(KEY_ID_BYTES).toString("base64url");
+        await db.insert(secrets).values({
+            keyId,
+            type: "jwt_signing",
+            value: JSON.stringify({ private: privatePem, public: publicPem }),
+            algorithm: "RS256",
+            isActive: true,
+            rotatedAt: new Date(),
+        });
+        return { keyId, privateKey: pair.privateKey, publicKey: pair.publicKey };
+    }
+    async loadKeyPair(record) {
+        const parsed = JSON.parse(record.value);
+        const privateKey = await importPKCS8(parsed.private, "RS256");
+        const publicKey = await importSPKI(parsed.public, "RS256");
+        return { keyId: record.keyId, privateKey, publicKey };
+    }
+    async getEncryptionKey() {
+        if (config.KEYSTONE_ENCRYPTION_KEY) {
+            return crypto.createHash("sha256").update(config.KEYSTONE_ENCRYPTION_KEY).digest();
+        }
+        const [active] = await db
+            .select()
+            .from(secrets)
+            .where(and(eq(secrets.type, "encryption"), eq(secrets.isActive, true)))
+            .limit(1);
+        if (active) {
+            return Buffer.from(active.value, "base64url");
+        }
+        const value = crypto.randomBytes(32);
+        await db.insert(secrets).values({
+            keyId: `enc-${crypto.randomBytes(KEY_ID_BYTES).toString("base64url")}`,
+            type: "encryption",
+            value: value.toString("base64url"),
+            algorithm: "aes-256-gcm",
+            isActive: true,
+        });
+        return value;
+    }
+    async encryptSecret(plain) {
+        const key = await this.getEncryptionKey();
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const cipher = crypto.createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
+        const encrypted = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const payload = Buffer.concat([iv, tag, encrypted]);
+        return `${ENCRYPTION_ALGORITHM}$${payload.toString("base64url")}`;
+    }
+    async decryptSecret(cipherText) {
+        if (!cipherText.startsWith(`${ENCRYPTION_ALGORITHM}$`)) {
+            throw new Error("Unsupported cipher format");
+        }
+        const key = await this.getEncryptionKey();
+        const payload = Buffer.from(cipherText.slice(`${ENCRYPTION_ALGORITHM}$`.length), "base64url");
+        const iv = payload.subarray(0, IV_LENGTH);
+        const tag = payload.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+        const encrypted = payload.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+        const decipher = crypto.createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8");
+    }
+    async listActiveSigningKeys() {
+        const rows = await db
+            .select({ keyId: secrets.keyId, createdAt: secrets.createdAt, expiresAt: secrets.expiresAt })
+            .from(secrets)
+            .where(and(eq(secrets.type, "jwt_signing"), eq(secrets.isActive, true)))
+            .orderBy(secrets.createdAt);
+        return rows;
+    }
+    async listValidSigningKeys() {
+        const now = new Date();
+        const rows = await db
+            .select()
+            .from(secrets)
+            .where(and(eq(secrets.type, "jwt_signing"), or(eq(secrets.isActive, true), and(eq(secrets.isActive, false), gt(secrets.expiresAt, now)))))
+            .orderBy(secrets.createdAt);
+        return Promise.all(rows.map((row) => this.loadKeyPair(row)));
+    }
+}
+//# sourceMappingURL=database.js.map

package/dist/services/secrets/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/services/secrets/database.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAgB,MAAM,MAAM,CAAC;AACvG,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,OAAO,EAAe,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAC3C,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,MAAM,OAAO,uBAAuB;IACzB,IAAI,GAAG,UAAU,CAAC;IAE3B,YAAY,GAAG,YAAY,CAAC;IAC5B,cAAc,GAAG,cAAc,CAAC;IAEhC,UAAU,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;QAClB,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;aAClG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,SAAS,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;aAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAErE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC9B,KAAK;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACjE,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAwC,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC;QACrF,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aACtE,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,OAAO,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;YACtE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,SAAS,EAAE,aAAa;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,OAAO,GAAG,oBAAoB,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,oBAAoB,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QAC9F,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5F,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aACvE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,EAC/B,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAC7F,CACF;aACA,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/services/secrets/environment.d.ts

@@ -0,0 +1,27 @@
+import type { SecretsProvider, SigningKeyPair } from "./provider.js";
+import { hashPassword, verifyPassword } from "./password.js";
+export declare class EnvironmentSecretsProvider implements SecretsProvider {
+    readonly name = "environment";
+    hashPassword: typeof hashPassword;
+    verifyPassword: typeof verifyPassword;
+    hashApiKey(key: string): string;
+    hashClientSecret(secret: string): string;
+    generateClientSecret(): string;
+    generateApiKey(): {
+        key: string;
+        prefix: string;
+    };
+    getActiveSigningKey(): Promise<SigningKeyPair>;
+    getSigningKeyById(keyId: string): Promise<SigningKeyPair | undefined>;
+    rotateSigningKeys(): Promise<SigningKeyPair>;
+    listActiveSigningKeys(): Promise<{
+        keyId: string;
+        createdAt: Date;
+        expiresAt?: Date | null;
+    }[]>;
+    listValidSigningKeys(): Promise<SigningKeyPair[]>;
+    getEncryptionKey(): Promise<Buffer>;
+    encryptSecret(plain: string): Promise<string>;
+    decryptSecret(cipherText: string): Promise<string>;
+}
+//# sourceMappingURL=environment.d.ts.map

package/dist/services/secrets/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/environment.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAK7D,qBAAa,0BAA2B,YAAW,eAAe;IAChE,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,YAAY,sBAAgB;IAC5B,cAAc,wBAAkB;IAEhC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI/B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIxC,oBAAoB,IAAI,MAAM;IAI9B,cAAc,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAM3C,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC;IA2B9C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAMrE,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC;IAK5C,qBAAqB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAK/F,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAKjD,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAYnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAazD"}

package/dist/services/secrets/environment.js

@@ -0,0 +1,102 @@
+import crypto from "node:crypto";
+import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair } from "jose";
+import { config } from "../../config.js";
+import { hashPassword, verifyPassword } from "./password.js";
+let envKeyPair = null;
+let envEncryptionKey = null;
+export class EnvironmentSecretsProvider {
+    name = "environment";
+    hashPassword = hashPassword;
+    verifyPassword = verifyPassword;
+    hashApiKey(key) {
+        return crypto.createHash("sha256").update(key).digest("hex");
+    }
+    hashClientSecret(secret) {
+        return crypto.createHash("sha256").update(secret).digest("hex");
+    }
+    generateClientSecret() {
+        return `cs_${crypto.randomBytes(32).toString("base64url")}`;
+    }
+    generateApiKey() {
+        const key = `ks_${crypto.randomBytes(32).toString("base64url")}`;
+        const prefix = key.slice(0, 7);
+        return { key, prefix };
+    }
+    async getActiveSigningKey() {
+        if (envKeyPair)
+            return envKeyPair;
+        if (config.JWT_PRIVATE_KEY && config.JWT_PUBLIC_KEY) {
+            const privateKey = await importPKCS8(config.JWT_PRIVATE_KEY, "RS256");
+            const publicKey = await importSPKI(config.JWT_PUBLIC_KEY, "RS256");
+            envKeyPair = { keyId: "env", privateKey, publicKey };
+            return envKeyPair;
+        }
+        if (config.NODE_ENV === "production") {
+            throw new Error("EnvironmentSecretsProvider requires JWT_PRIVATE_KEY and JWT_PUBLIC_KEY in production");
+        }
+        const pair = await generateKeyPair("RS256", { extractable: true });
+        const privatePem = await exportPKCS8(pair.privateKey);
+        const publicPem = await exportSPKI(pair.publicKey);
+        // eslint-disable-next-line no-console
+        console.warn("[secrets] Generated ephemeral JWT keys. Set JWT_PRIVATE_KEY/JWT_PUBLIC_KEY in production.");
+        // eslint-disable-next-line no-console
+        console.warn("[secrets] JWT_PRIVATE_KEY\n", privatePem);
+        // eslint-disable-next-line no-console
+        console.warn("[secrets] JWT_PUBLIC_KEY\n", publicPem);
+        envKeyPair = { keyId: "env-generated", privateKey: pair.privateKey, publicKey: pair.publicKey };
+        return envKeyPair;
+    }
+    async getSigningKeyById(keyId) {
+        const active = await this.getActiveSigningKey();
+        if (active.keyId === keyId)
+            return active;
+        return undefined;
+    }
+    async rotateSigningKeys() {
+        envKeyPair = null;
+        return this.getActiveSigningKey();
+    }
+    async listActiveSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [{ keyId: active.keyId, createdAt: new Date(), expiresAt: null }];
+    }
+    async listValidSigningKeys() {
+        const active = await this.getActiveSigningKey();
+        return [active];
+    }
+    async getEncryptionKey() {
+        if (envEncryptionKey)
+            return envEncryptionKey;
+        if (config.KEYSTONE_ENCRYPTION_KEY) {
+            envEncryptionKey = crypto.createHash("sha256").update(config.KEYSTONE_ENCRYPTION_KEY).digest();
+            return envEncryptionKey;
+        }
+        envEncryptionKey = crypto.randomBytes(32);
+        // eslint-disable-next-line no-console
+        console.warn("[secrets] Generated ephemeral encryption key. Set KEYSTONE_ENCRYPTION_KEY in production.");
+        return envEncryptionKey;
+    }
+    async encryptSecret(plain) {
+        const key = await this.getEncryptionKey();
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+        const encrypted = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const payload = Buffer.concat([iv, tag, encrypted]);
+        return `aes-256-gcm$${payload.toString("base64url")}`;
+    }
+    async decryptSecret(cipherText) {
+        if (!cipherText.startsWith("aes-256-gcm$")) {
+            throw new Error("Unsupported cipher format");
+        }
+        const key = await this.getEncryptionKey();
+        const payload = Buffer.from(cipherText.slice("aes-256-gcm$".length), "base64url");
+        const iv = payload.subarray(0, 16);
+        const tag = payload.subarray(16, 32);
+        const encrypted = payload.subarray(32);
+        const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8");
+    }
+}
+//# sourceMappingURL=environment.js.map

package/dist/services/secrets/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/services/secrets/environment.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAgB,MAAM,MAAM,CAAC;AACvG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,IAAI,UAAU,GAA0B,IAAI,CAAC;AAC7C,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,MAAM,OAAO,0BAA0B;IAC5B,IAAI,GAAG,aAAa,CAAC;IAE9B,YAAY,GAAG,YAAY,CAAC;IAC5B,cAAc,GAAG,cAAc,CAAC;IAEhC,UAAU,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;QAClB,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACnE,UAAU,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YACrD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QAC1G,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;QACxD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;QACtD,UAAU,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChG,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACnC,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC;YAC/F,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1C,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACzG,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,OAAO,eAAe,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;CACF"}

package/dist/services/secrets/index.d.ts

@@ -0,0 +1,30 @@
+import type { SecretsProvider } from "./provider.js";
+export declare const secretsProvider: SecretsProvider;
+export * from "./provider.js";
+export { DatabaseSecretsProvider } from "./database.js";
+export { EnvironmentSecretsProvider } from "./environment.js";
+export { VaultSecretsProvider } from "./vault.js";
+export { AwsKmsSecretsProvider } from "./awsKms.js";
+export { AzureKeyVaultSecretsProvider } from "./azureKeyVault.js";
+export declare const hashPassword: (plain: string) => Promise<string>;
+export declare const verifyPassword: (plain: string, hash: string | null | undefined) => Promise<boolean>;
+export declare const hashApiKey: (key: string) => string;
+export declare const hashClientSecret: (secret: string) => string;
+export declare const generateClientSecret: () => string;
+export declare const generateApiKey: () => {
+    key: string;
+    prefix: string;
+};
+export declare const getActiveSigningKey: () => Promise<import("./provider.js").SigningKeyPair>;
+export declare const getSigningKeyById: (keyId: string) => Promise<import("./provider.js").SigningKeyPair | undefined>;
+export declare const rotateSigningKeys: () => Promise<import("./provider.js").SigningKeyPair>;
+export declare const listActiveSigningKeys: () => Promise<{
+    keyId: string;
+    createdAt: Date;
+    expiresAt?: Date | null;
+}[]>;
+export declare const listValidSigningKeys: () => Promise<import("./provider.js").SigningKeyPair[]>;
+export declare const getEncryptionKey: () => Promise<Buffer>;
+export declare const encryptSecret: (plain: string) => Promise<string>;
+export declare const decryptSecret: (cipherText: string) => Promise<string>;
+//# sourceMappingURL=index.d.ts.map

package/dist/services/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAmBrD,eAAO,MAAM,eAAe,EAAE,eAAkC,CAAC;AAGjE,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAGlE,eAAO,MAAM,YAAY,oCAAqD,CAAC;AAC/E,eAAO,MAAM,cAAc,sEAAuD,CAAC;AACnF,eAAO,MAAM,UAAU,yBAAmD,CAAC;AAC3E,eAAO,MAAM,gBAAgB,4BAAyD,CAAC;AACvF,eAAO,MAAM,oBAAoB,cAA6D,CAAC;AAC/F,eAAO,MAAM,cAAc;;;CAAuD,CAAC;AACnF,eAAO,MAAM,mBAAmB,uDAA4D,CAAC;AAC7F,eAAO,MAAM,iBAAiB,gFAA0D,CAAC;AACzF,eAAO,MAAM,iBAAiB,uDAA0D,CAAC;AACzF,eAAO,MAAM,qBAAqB;;;aAxB1B,CAAC;IAwBuF,CAAC;AACjG,eAAO,MAAM,oBAAoB,yDAA6D,CAAC;AAC/F,eAAO,MAAM,gBAAgB,uBAAyD,CAAC;AACvF,eAAO,MAAM,aAAa,oCAAsD,CAAC;AACjF,eAAO,MAAM,aAAa,yCAAsD,CAAC"}

package/dist/services/secrets/index.js

@@ -0,0 +1,46 @@
+import { config } from "../../config.js";
+import { DatabaseSecretsProvider } from "./database.js";
+import { EnvironmentSecretsProvider } from "./environment.js";
+import { VaultSecretsProvider } from "./vault.js";
+import { AwsKmsSecretsProvider } from "./awsKms.js";
+import { AzureKeyVaultSecretsProvider } from "./azureKeyVault.js";
+function createProvider() {
+    const providerName = config.KEYSTONE_SECRETS_PROVIDER || "database";
+    switch (providerName) {
+        case "environment":
+            return new EnvironmentSecretsProvider();
+        case "vault":
+            return new VaultSecretsProvider();
+        case "aws-kms":
+            return new AwsKmsSecretsProvider();
+        case "azure-key-vault":
+            return new AzureKeyVaultSecretsProvider();
+        case "database":
+        default:
+            return new DatabaseSecretsProvider();
+    }
+}
+export const secretsProvider = createProvider();
+// Re-export everything for backwards compatibility.
+export * from "./provider.js";
+export { DatabaseSecretsProvider } from "./database.js";
+export { EnvironmentSecretsProvider } from "./environment.js";
+export { VaultSecretsProvider } from "./vault.js";
+export { AwsKmsSecretsProvider } from "./awsKms.js";
+export { AzureKeyVaultSecretsProvider } from "./azureKeyVault.js";
+// Convenience re-exports of the active provider's methods.
+export const hashPassword = secretsProvider.hashPassword.bind(secretsProvider);
+export const verifyPassword = secretsProvider.verifyPassword.bind(secretsProvider);
+export const hashApiKey = secretsProvider.hashApiKey.bind(secretsProvider);
+export const hashClientSecret = secretsProvider.hashClientSecret.bind(secretsProvider);
+export const generateClientSecret = secretsProvider.generateClientSecret.bind(secretsProvider);
+export const generateApiKey = secretsProvider.generateApiKey.bind(secretsProvider);
+export const getActiveSigningKey = secretsProvider.getActiveSigningKey.bind(secretsProvider);
+export const getSigningKeyById = secretsProvider.getSigningKeyById.bind(secretsProvider);
+export const rotateSigningKeys = secretsProvider.rotateSigningKeys.bind(secretsProvider);
+export const listActiveSigningKeys = secretsProvider.listActiveSigningKeys.bind(secretsProvider);
+export const listValidSigningKeys = secretsProvider.listValidSigningKeys.bind(secretsProvider);
+export const getEncryptionKey = secretsProvider.getEncryptionKey.bind(secretsProvider);
+export const encryptSecret = secretsProvider.encryptSecret.bind(secretsProvider);
+export const decryptSecret = secretsProvider.decryptSecret.bind(secretsProvider);
+//# sourceMappingURL=index.js.map

package/dist/services/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAGlE,SAAS,cAAc;IACrB,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,IAAI,UAAU,CAAC;IACpE,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACrC,KAAK,iBAAiB;YACpB,OAAO,IAAI,4BAA4B,EAAE,CAAC;QAC5C,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,IAAI,uBAAuB,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAoB,cAAc,EAAE,CAAC;AAEjE,oDAAoD;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAElE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC"}

package/dist/services/secrets/password.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hash a password using argon2id. The encoded string contains the salt and
+ * parameters, so verification does not need external storage.
+ */
+export declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a password against an argon2id or legacy scrypt hash.
+ */
+export declare function verifyPassword(plain: string, hash: string | null | undefined): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/services/secrets/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/password.ts"],"names":[],"mappings":"AAyCA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOjE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/services/secrets/password.js

@@ -0,0 +1,62 @@
+import crypto from "node:crypto";
+import * as argon2 from "argon2";
+// OWASP-recommended minimum parameters for argon2id (as of 2023).
+const ARGON2_MEMORY_COST = 65536;
+const ARGON2_TIME_COST = 3;
+const ARGON2_PARALLELISM = 4;
+// Legacy scrypt parameters used by early Keystone deployments.
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+function scryptPromise(password, salt, keylen, options) {
+    return new Promise((resolve, reject) => {
+        crypto.scrypt(password, salt, keylen, options, (err, derived) => {
+            if (err)
+                return reject(err);
+            resolve(derived);
+        });
+    });
+}
+async function verifyScryptPassword(plain, hash) {
+    const parts = hash.split("$");
+    if (parts.length !== 6)
+        return false;
+    const [, nStr, rStr, pStr, saltB64, derivedB64] = parts;
+    const salt = Buffer.from(saltB64, "base64url");
+    const expected = Buffer.from(derivedB64, "base64url");
+    const derived = await scryptPromise(plain, salt, expected.length, {
+        N: Number(nStr),
+        r: Number(rStr),
+        p: Number(pStr),
+    });
+    return crypto.timingSafeEqual(derived, expected);
+}
+/**
+ * Hash a password using argon2id. The encoded string contains the salt and
+ * parameters, so verification does not need external storage.
+ */
+export async function hashPassword(plain) {
+    return argon2.hash(plain, {
+        type: argon2.argon2id,
+        memoryCost: ARGON2_MEMORY_COST,
+        timeCost: ARGON2_TIME_COST,
+        parallelism: ARGON2_PARALLELISM,
+    });
+}
+/**
+ * Verify a password against an argon2id or legacy scrypt hash.
+ */
+export async function verifyPassword(plain, hash) {
+    if (!hash)
+        return false;
+    if (hash.startsWith("scrypt$")) {
+        return verifyScryptPassword(plain, hash);
+    }
+    try {
+        return await argon2.verify(hash, plain);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=password.js.map

package/dist/services/secrets/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/services/secrets/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,kEAAkE;AAClE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,+DAA+D;AAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB,SAAS,aAAa,CACpB,QAAgB,EAChB,IAAY,EACZ,MAAc,EACd,OAA6B;IAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC9D,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAY;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE;QAChE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;QACf,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;QACf,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,UAAU,EAAE,kBAAkB;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,kBAAkB;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/services/secrets/provider.d.ts

@@ -0,0 +1,36 @@
+import type { KeyLike } from "jose";
+export interface SigningKeyPair {
+    keyId: string;
+    privateKey: KeyLike | Uint8Array;
+    publicKey: KeyLike;
+}
+export interface SecretsProvider {
+    readonly name: string;
+    hashPassword(plain: string): Promise<string>;
+    verifyPassword(plain: string, hash: string | null | undefined): Promise<boolean>;
+    hashApiKey(key: string): string;
+    hashClientSecret(secret: string): string;
+    generateClientSecret(): string;
+    generateApiKey(): {
+        key: string;
+        prefix: string;
+    };
+    getActiveSigningKey(): Promise<SigningKeyPair>;
+    getSigningKeyById(keyId: string): Promise<SigningKeyPair | undefined>;
+    rotateSigningKeys(): Promise<SigningKeyPair>;
+    listActiveSigningKeys(): Promise<{
+        keyId: string;
+        createdAt: Date;
+        expiresAt?: Date | null;
+    }[]>;
+    /**
+     * Return all signing keys that are currently valid: the active key plus any
+     * recently rotated keys still within the grace period. Used to verify tokens
+     * after a key rotation.
+     */
+    listValidSigningKeys(): Promise<SigningKeyPair[]>;
+    getEncryptionKey(): Promise<Buffer>;
+    encryptSecret(plain: string): Promise<string>;
+    decryptSecret(cipherText: string): Promise<string>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/services/secrets/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,GAAG,UAAU,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGjF,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,oBAAoB,IAAI,MAAM,CAAC;IAC/B,cAAc,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAGlD,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7C,qBAAqB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAC;IAChG;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAGlD,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD"}

package/dist/services/secrets/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/services/secrets/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/services/secrets/provider.ts"],"names":[],"mappings":""}

package/dist/services/secrets/vault.d.ts

@@ -0,0 +1,41 @@
+import type { SecretsProvider, SigningKeyPair } from "./provider.js";
+import { hashPassword, verifyPassword } from "./password.js";
+/**
+ * HashiCorp Vault secrets provider.
+ *
+ * This is a reference implementation. In production it should call the
+ * Vault HTTP API (or use a Vault client library) to retrieve signing keys,
+ * encryption keys, and credentials. The password hashing helpers are reused
+ * locally because they are compute-bound and do not need external storage.
+ */
+export declare class VaultSecretsProvider implements SecretsProvider {
+    readonly name = "vault";
+    hashPassword: typeof hashPassword;
+    verifyPassword: typeof verifyPassword;
+    private vaultAddr;
+    private vaultToken;
+    private mountPath;
+    constructor();
+    hashApiKey(key: string): string;
+    hashClientSecret(secret: string): string;
+    generateClientSecret(): string;
+    generateApiKey(): {
+        key: string;
+        prefix: string;
+    };
+    getActiveSigningKey(): Promise<SigningKeyPair>;
+    getSigningKeyById(keyId: string): Promise<SigningKeyPair | undefined>;
+    rotateSigningKeys(): Promise<SigningKeyPair>;
+    listActiveSigningKeys(): Promise<{
+        keyId: string;
+        createdAt: Date;
+        expiresAt?: Date | null;
+    }[]>;
+    listValidSigningKeys(): Promise<SigningKeyPair[]>;
+    getEncryptionKey(): Promise<Buffer>;
+    encryptSecret(plain: string): Promise<string>;
+    decryptSecret(cipherText: string): Promise<string>;
+    private readPath;
+    private writePath;
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/services/secrets/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/services/secrets/vault.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;GAOG;AACH,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,QAAQ,CAAC,IAAI,WAAW;IAExB,YAAY,sBAAgB;IAC5B,cAAc,wBAAkB;IAEhC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;;IAY1B,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI/B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIxC,oBAAoB,IAAI,MAAM;IAI9B,cAAc,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAK3C,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC;IAU9C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAUrE,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC;IAW5C,qBAAqB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAK/F,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAKjD,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAUnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAc1C,QAAQ;YAWR,SAAS;CAYxB"}