@invect/core 0.0.1

package/dist/services/credentials/encryption.service.cjs

@@ -0,0 +1,121 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+let crypto = require("crypto");
+crypto = require_runtime.__toESM(crypto);
+//#region src/services/credentials/encryption.service.ts
+/**
+* Encryption Service
+*
+* Handles encryption and decryption of sensitive credential data
+* Uses AES-256-GCM for authenticated encryption
+*/
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 16;
+const SALT_LENGTH = 32;
+var EncryptionService = class {
+	masterKey;
+	constructor(config) {
+		if (!config.masterKey) throw new Error("Master encryption key is required");
+		this.masterKey = Buffer.from(config.masterKey, "utf-8");
+	}
+	/**
+	* Encrypt data using AES-256-GCM
+	* Returns an object with ciphertext, IV, auth tag, and salt
+	*/
+	encrypt(plaintext) {
+		try {
+			const plaintextString = typeof plaintext === "string" ? plaintext : JSON.stringify(plaintext);
+			const salt = crypto.default.randomBytes(SALT_LENGTH);
+			const key = crypto.default.pbkdf2Sync(this.masterKey, salt, 1e5, 32, "sha256");
+			const iv = crypto.default.randomBytes(IV_LENGTH);
+			const cipher = crypto.default.createCipheriv(ALGORITHM, key, iv);
+			let ciphertext = cipher.update(plaintextString, "utf8", "base64");
+			ciphertext += cipher.final("base64");
+			const authTag = cipher.getAuthTag();
+			return {
+				ciphertext,
+				iv: iv.toString("base64"),
+				authTag: authTag.toString("base64"),
+				salt: salt.toString("base64"),
+				algorithm: ALGORITHM
+			};
+		} catch (error) {
+			throw new Error(`Encryption failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+		}
+	}
+	/**
+	* Decrypt data that was encrypted with encrypt()
+	* Returns the original plaintext
+	*/
+	decrypt(encrypted) {
+		try {
+			const { ciphertext, iv, authTag, salt, algorithm } = encrypted;
+			if (algorithm !== ALGORITHM) throw new Error(`Unsupported algorithm: ${algorithm}`);
+			const ivBuffer = Buffer.from(iv, "base64");
+			const authTagBuffer = Buffer.from(authTag, "base64");
+			const saltBuffer = Buffer.from(salt, "base64");
+			const key = crypto.default.pbkdf2Sync(this.masterKey, saltBuffer, 1e5, 32, "sha256");
+			const decipher = crypto.default.createDecipheriv(ALGORITHM, key, ivBuffer);
+			decipher.setAuthTag(authTagBuffer);
+			let plaintext = decipher.update(ciphertext, "base64", "utf8");
+			plaintext += decipher.final("utf8");
+			return plaintext;
+		} catch (error) {
+			throw new Error(`Decryption failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+		}
+	}
+	/**
+	* Encrypt an object and return as an encrypted string
+	* Useful for storing in database
+	*/
+	encryptObject(obj) {
+		const encrypted = this.encrypt(obj);
+		return JSON.stringify(encrypted);
+	}
+	/**
+	* Decrypt a string that was encrypted with encryptObject()
+	* Returns the original object
+	*/
+	decryptObject(encryptedString) {
+		const encrypted = JSON.parse(encryptedString);
+		const decrypted = this.decrypt(encrypted);
+		return JSON.parse(decrypted);
+	}
+	/**
+	* Hash a value using SHA-256
+	* Useful for creating searchable hashes of sensitive data
+	*/
+	hash(value) {
+		return crypto.default.createHash("sha256").update(value).digest("hex");
+	}
+	/**
+	* Generate a cryptographically secure random token
+	* Useful for API keys, tokens, etc.
+	*/
+	generateToken(length = 32) {
+		return crypto.default.randomBytes(length).toString("hex");
+	}
+	/**
+	* Validate encryption key strength
+	* Returns true if the key meets minimum security requirements
+	*/
+	static validateMasterKey(key) {
+		if (key.length < 32) return false;
+		return [
+			/[A-Z]/.test(key),
+			/[a-z]/.test(key),
+			/[0-9]/.test(key),
+			/[^A-Za-z0-9]/.test(key)
+		].filter(Boolean).length >= 3;
+	}
+	/**
+	* Generate a new master key
+	* Should be stored securely (e.g., in environment variable or secret manager)
+	*/
+	static generateMasterKey() {
+		return crypto.default.randomBytes(32).toString("base64");
+	}
+};
+//#endregion
+exports.EncryptionService = EncryptionService;
+
+//# sourceMappingURL=encryption.service.cjs.map

package/dist/services/credentials/encryption.service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.cjs","names":[],"sources":["../../../src/services/credentials/encryption.service.ts"],"sourcesContent":["/**\n * Encryption Service\n *\n * Handles encryption and decryption of sensitive credential data\n * Uses AES-256-GCM for authenticated encryption\n */\n\nimport crypto from 'crypto';\n\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 16;\nconst SALT_LENGTH = 32;\n\nexport interface EncryptionConfig {\n  /** Master encryption key (should be loaded from environment variable) */\n  masterKey: string;\n}\n\nexport interface EncryptedData {\n  /** Encrypted data as base64 string */\n  ciphertext: string;\n  /** Initialization vector as base64 string */\n  iv: string;\n  /** Authentication tag as base64 string */\n  authTag: string;\n  /** Salt used for key derivation as base64 string */\n  salt: string;\n  /** Algorithm used */\n  algorithm: string;\n}\n\nexport class EncryptionService {\n  private masterKey: Buffer;\n\n  constructor(config: EncryptionConfig) {\n    if (!config.masterKey) {\n      throw new Error('Master encryption key is required');\n    }\n\n    // Store the master key as a buffer\n    this.masterKey = Buffer.from(config.masterKey, 'utf-8');\n  }\n\n  /**\n   * Encrypt data using AES-256-GCM\n   * Returns an object with ciphertext, IV, auth tag, and salt\n   */\n  encrypt(plaintext: string | object): EncryptedData {\n    try {\n      // Convert object to string if needed\n      const plaintextString = typeof plaintext === 'string' ? plaintext : JSON.stringify(plaintext);\n\n      // Generate a random salt for key derivation\n      const salt = crypto.randomBytes(SALT_LENGTH);\n\n      // Derive a key from the master key and salt using PBKDF2\n      const key = crypto.pbkdf2Sync(\n        this.masterKey,\n        salt,\n        100000, // iterations\n        32, // key length in bytes (256 bits)\n        'sha256',\n      );\n\n      // Generate a random initialization vector\n      const iv = crypto.randomBytes(IV_LENGTH);\n\n      // Create cipher\n      const cipher = crypto.createCipheriv(ALGORITHM, key, iv);\n\n      // Encrypt the data\n      let ciphertext = cipher.update(plaintextString, 'utf8', 'base64');\n      ciphertext += cipher.final('base64');\n\n      // Get the authentication tag\n      const authTag = cipher.getAuthTag();\n\n      return {\n        ciphertext,\n        iv: iv.toString('base64'),\n        authTag: authTag.toString('base64'),\n        salt: salt.toString('base64'),\n        algorithm: ALGORITHM,\n      };\n    } catch (error) {\n      throw new Error(\n        `Encryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`,\n      );\n    }\n  }\n\n  /**\n   * Decrypt data that was encrypted with encrypt()\n   * Returns the original plaintext\n   */\n  decrypt(encrypted: EncryptedData): string {\n    try {\n      // Parse the encrypted data\n      const { ciphertext, iv, authTag, salt, algorithm } = encrypted;\n\n      if (algorithm !== ALGORITHM) {\n        throw new Error(`Unsupported algorithm: ${algorithm}`);\n      }\n\n      // Convert base64 strings back to buffers\n      const ivBuffer = Buffer.from(iv, 'base64');\n      const authTagBuffer = Buffer.from(authTag, 'base64');\n      const saltBuffer = Buffer.from(salt, 'base64');\n\n      // Derive the same key using the stored salt\n      const key = crypto.pbkdf2Sync(this.masterKey, saltBuffer, 100000, 32, 'sha256');\n\n      // Create decipher\n      const decipher = crypto.createDecipheriv(ALGORITHM, key, ivBuffer);\n      decipher.setAuthTag(authTagBuffer);\n\n      // Decrypt the data\n      let plaintext = decipher.update(ciphertext, 'base64', 'utf8');\n      plaintext += decipher.final('utf8');\n\n      return plaintext;\n    } catch (error) {\n      throw new Error(\n        `Decryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`,\n      );\n    }\n  }\n\n  /**\n   * Encrypt an object and return as an encrypted string\n   * Useful for storing in database\n   */\n  encryptObject<T extends object>(obj: T): string {\n    const encrypted = this.encrypt(obj);\n    return JSON.stringify(encrypted);\n  }\n\n  /**\n   * Decrypt a string that was encrypted with encryptObject()\n   * Returns the original object\n   */\n  decryptObject<T extends object>(encryptedString: string): T {\n    const encrypted = JSON.parse(encryptedString) as EncryptedData;\n    const decrypted = this.decrypt(encrypted);\n    return JSON.parse(decrypted) as T;\n  }\n\n  /**\n   * Hash a value using SHA-256\n   * Useful for creating searchable hashes of sensitive data\n   */\n  hash(value: string): string {\n    return crypto.createHash('sha256').update(value).digest('hex');\n  }\n\n  /**\n   * Generate a cryptographically secure random token\n   * Useful for API keys, tokens, etc.\n   */\n  generateToken(length: number = 32): string {\n    return crypto.randomBytes(length).toString('hex');\n  }\n\n  /**\n   * Validate encryption key strength\n   * Returns true if the key meets minimum security requirements\n   */\n  static validateMasterKey(key: string): boolean {\n    // Minimum 32 characters (256 bits)\n    if (key.length < 32) {\n      return false;\n    }\n\n    // Should contain mix of characters\n    const hasUpperCase = /[A-Z]/.test(key);\n    const hasLowerCase = /[a-z]/.test(key);\n    const hasNumbers = /[0-9]/.test(key);\n    const hasSpecial = /[^A-Za-z0-9]/.test(key);\n\n    // Require at least 3 of the 4 character types\n    const characterTypes = [hasUpperCase, hasLowerCase, hasNumbers, hasSpecial].filter(\n      Boolean,\n    ).length;\n\n    return characterTypes >= 3;\n  }\n\n  /**\n   * Generate a new master key\n   * Should be stored securely (e.g., in environment variable or secret manager)\n   */\n  static generateMasterKey(): string {\n    return crypto.randomBytes(32).toString('base64');\n  }\n}\n\n/**\n * Factory function to create encryption service from environment\n */\nexport function createEncryptionService(): EncryptionService {\n  const masterKey = process.env.INVECT_ENCRYPTION_KEY;\n\n  if (!masterKey) {\n    throw new Error(\n      'INVECT_ENCRYPTION_KEY environment variable is required. ' +\n        \"Generate one with: node -e \\\"console.log(require('crypto').randomBytes(32).toString('base64'))\\\"\",\n    );\n  }\n\n  if (!EncryptionService.validateMasterKey(masterKey)) {\n    // Warn about weak encryption key (in production, should throw error)\n    throw new Error(\n      'Encryption key does not meet security requirements. ' +\n        'It should be at least 32 characters and contain a mix of character types.',\n    );\n  }\n\n  return new EncryptionService({ masterKey });\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,cAAc;AAoBpB,IAAa,oBAAb,MAA+B;CAC7B;CAEA,YAAY,QAA0B;AACpC,MAAI,CAAC,OAAO,UACV,OAAM,IAAI,MAAM,oCAAoC;AAItD,OAAK,YAAY,OAAO,KAAK,OAAO,WAAW,QAAQ;;;;;;CAOzD,QAAQ,WAA2C;AACjD,MAAI;GAEF,MAAM,kBAAkB,OAAO,cAAc,WAAW,YAAY,KAAK,UAAU,UAAU;GAG7F,MAAM,OAAO,OAAA,QAAO,YAAY,YAAY;GAG5C,MAAM,MAAM,OAAA,QAAO,WACjB,KAAK,WACL,MACA,KACA,IACA,SACD;GAGD,MAAM,KAAK,OAAA,QAAO,YAAY,UAAU;GAGxC,MAAM,SAAS,OAAA,QAAO,eAAe,WAAW,KAAK,GAAG;GAGxD,IAAI,aAAa,OAAO,OAAO,iBAAiB,QAAQ,SAAS;AACjE,iBAAc,OAAO,MAAM,SAAS;GAGpC,MAAM,UAAU,OAAO,YAAY;AAEnC,UAAO;IACL;IACA,IAAI,GAAG,SAAS,SAAS;IACzB,SAAS,QAAQ,SAAS,SAAS;IACnC,MAAM,KAAK,SAAS,SAAS;IAC7B,WAAW;IACZ;WACM,OAAO;AACd,SAAM,IAAI,MACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,kBAChE;;;;;;;CAQL,QAAQ,WAAkC;AACxC,MAAI;GAEF,MAAM,EAAE,YAAY,IAAI,SAAS,MAAM,cAAc;AAErD,OAAI,cAAc,UAChB,OAAM,IAAI,MAAM,0BAA0B,YAAY;GAIxD,MAAM,WAAW,OAAO,KAAK,IAAI,SAAS;GAC1C,MAAM,gBAAgB,OAAO,KAAK,SAAS,SAAS;GACpD,MAAM,aAAa,OAAO,KAAK,MAAM,SAAS;GAG9C,MAAM,MAAM,OAAA,QAAO,WAAW,KAAK,WAAW,YAAY,KAAQ,IAAI,SAAS;GAG/E,MAAM,WAAW,OAAA,QAAO,iBAAiB,WAAW,KAAK,SAAS;AAClE,YAAS,WAAW,cAAc;GAGlC,IAAI,YAAY,SAAS,OAAO,YAAY,UAAU,OAAO;AAC7D,gBAAa,SAAS,MAAM,OAAO;AAEnC,UAAO;WACA,OAAO;AACd,SAAM,IAAI,MACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,kBAChE;;;;;;;CAQL,cAAgC,KAAgB;EAC9C,MAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,SAAO,KAAK,UAAU,UAAU;;;;;;CAOlC,cAAgC,iBAA4B;EAC1D,MAAM,YAAY,KAAK,MAAM,gBAAgB;EAC7C,MAAM,YAAY,KAAK,QAAQ,UAAU;AACzC,SAAO,KAAK,MAAM,UAAU;;;;;;CAO9B,KAAK,OAAuB;AAC1B,SAAO,OAAA,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;CAOhE,cAAc,SAAiB,IAAY;AACzC,SAAO,OAAA,QAAO,YAAY,OAAO,CAAC,SAAS,MAAM;;;;;;CAOnD,OAAO,kBAAkB,KAAsB;AAE7C,MAAI,IAAI,SAAS,GACf,QAAO;AAcT,SAJuB;GANF,QAAQ,KAAK,IAAI;GACjB,QAAQ,KAAK,IAAI;GACnB,QAAQ,KAAK,IAAI;GACjB,eAAe,KAAK,IAAI;GAGgC,CAAC,OAC1E,QACD,CAAC,UAEuB;;;;;;CAO3B,OAAO,oBAA4B;AACjC,SAAO,OAAA,QAAO,YAAY,GAAG,CAAC,SAAS,SAAS"}

package/dist/services/credentials/encryption.service.d.cts

@@ -0,0 +1,70 @@
+//#region src/services/credentials/encryption.service.d.ts
+/**
+ * Encryption Service
+ *
+ * Handles encryption and decryption of sensitive credential data
+ * Uses AES-256-GCM for authenticated encryption
+ */
+interface EncryptionConfig {
+  /** Master encryption key (should be loaded from environment variable) */
+  masterKey: string;
+}
+interface EncryptedData {
+  /** Encrypted data as base64 string */
+  ciphertext: string;
+  /** Initialization vector as base64 string */
+  iv: string;
+  /** Authentication tag as base64 string */
+  authTag: string;
+  /** Salt used for key derivation as base64 string */
+  salt: string;
+  /** Algorithm used */
+  algorithm: string;
+}
+declare class EncryptionService {
+  private masterKey;
+  constructor(config: EncryptionConfig);
+  /**
+   * Encrypt data using AES-256-GCM
+   * Returns an object with ciphertext, IV, auth tag, and salt
+   */
+  encrypt(plaintext: string | object): EncryptedData;
+  /**
+   * Decrypt data that was encrypted with encrypt()
+   * Returns the original plaintext
+   */
+  decrypt(encrypted: EncryptedData): string;
+  /**
+   * Encrypt an object and return as an encrypted string
+   * Useful for storing in database
+   */
+  encryptObject<T extends object>(obj: T): string;
+  /**
+   * Decrypt a string that was encrypted with encryptObject()
+   * Returns the original object
+   */
+  decryptObject<T extends object>(encryptedString: string): T;
+  /**
+   * Hash a value using SHA-256
+   * Useful for creating searchable hashes of sensitive data
+   */
+  hash(value: string): string;
+  /**
+   * Generate a cryptographically secure random token
+   * Useful for API keys, tokens, etc.
+   */
+  generateToken(length?: number): string;
+  /**
+   * Validate encryption key strength
+   * Returns true if the key meets minimum security requirements
+   */
+  static validateMasterKey(key: string): boolean;
+  /**
+   * Generate a new master key
+   * Should be stored securely (e.g., in environment variable or secret manager)
+   */
+  static generateMasterKey(): string;
+}
+//#endregion
+export { EncryptedData, EncryptionConfig, EncryptionService };
+//# sourceMappingURL=encryption.service.d.cts.map

package/dist/services/credentials/encryption.service.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.d.cts","names":[],"sources":["../../../src/services/credentials/encryption.service.ts"],"mappings":";;AAaA;;;;;UAAiB,gBAAA;EAKa;EAH5B,SAAA;AAAA;AAAA,UAGe,aAAA;EAIf;EAFA,UAAA;EAMA;EAJA,EAAA;EAMS;EAJT,OAAA;EAOW;EALX,IAAA;EAK4B;EAH5B,SAAA;AAAA;AAAA,cAGW,iBAAA;EAAA,QACH,SAAA;cAEI,MAAA,EAAQ,gBAAA;EA2GuC;;;;EA9F3D,OAAA,CAAQ,SAAA,oBAA6B,aAAA;EAbzB;;;;EA6DZ,OAAA,CAAQ,SAAA,EAAW,aAAA;EAAA;;;;EAqCnB,aAAA,kBAAA,CAAgC,GAAA,EAAK,CAAA;EAAL;;;;EAShC,aAAA,kBAAA,CAAgC,eAAA,WAA0B,CAAA;EAU1D;;;;EAAA,IAAA,CAAK,KAAA;EAgBoB;;;;EARzB,aAAA,CAAc,MAAA;;;;;SAQP,iBAAA,CAAkB,GAAA;;;;;SAwBlB,iBAAA,CAAA;AAAA"}

package/dist/services/credentials/encryption.service.d.ts

@@ -0,0 +1,70 @@
+//#region src/services/credentials/encryption.service.d.ts
+/**
+ * Encryption Service
+ *
+ * Handles encryption and decryption of sensitive credential data
+ * Uses AES-256-GCM for authenticated encryption
+ */
+interface EncryptionConfig {
+  /** Master encryption key (should be loaded from environment variable) */
+  masterKey: string;
+}
+interface EncryptedData {
+  /** Encrypted data as base64 string */
+  ciphertext: string;
+  /** Initialization vector as base64 string */
+  iv: string;
+  /** Authentication tag as base64 string */
+  authTag: string;
+  /** Salt used for key derivation as base64 string */
+  salt: string;
+  /** Algorithm used */
+  algorithm: string;
+}
+declare class EncryptionService {
+  private masterKey;
+  constructor(config: EncryptionConfig);
+  /**
+   * Encrypt data using AES-256-GCM
+   * Returns an object with ciphertext, IV, auth tag, and salt
+   */
+  encrypt(plaintext: string | object): EncryptedData;
+  /**
+   * Decrypt data that was encrypted with encrypt()
+   * Returns the original plaintext
+   */
+  decrypt(encrypted: EncryptedData): string;
+  /**
+   * Encrypt an object and return as an encrypted string
+   * Useful for storing in database
+   */
+  encryptObject<T extends object>(obj: T): string;
+  /**
+   * Decrypt a string that was encrypted with encryptObject()
+   * Returns the original object
+   */
+  decryptObject<T extends object>(encryptedString: string): T;
+  /**
+   * Hash a value using SHA-256
+   * Useful for creating searchable hashes of sensitive data
+   */
+  hash(value: string): string;
+  /**
+   * Generate a cryptographically secure random token
+   * Useful for API keys, tokens, etc.
+   */
+  generateToken(length?: number): string;
+  /**
+   * Validate encryption key strength
+   * Returns true if the key meets minimum security requirements
+   */
+  static validateMasterKey(key: string): boolean;
+  /**
+   * Generate a new master key
+   * Should be stored securely (e.g., in environment variable or secret manager)
+   */
+  static generateMasterKey(): string;
+}
+//#endregion
+export { EncryptedData, EncryptionConfig, EncryptionService };
+//# sourceMappingURL=encryption.service.d.ts.map

package/dist/services/credentials/encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.d.ts","names":[],"sources":["../../../src/services/credentials/encryption.service.ts"],"mappings":";;AAaA;;;;;UAAiB,gBAAA;EAKa;EAH5B,SAAA;AAAA;AAAA,UAGe,aAAA;EAIf;EAFA,UAAA;EAMA;EAJA,EAAA;EAMS;EAJT,OAAA;EAOW;EALX,IAAA;EAK4B;EAH5B,SAAA;AAAA;AAAA,cAGW,iBAAA;EAAA,QACH,SAAA;cAEI,MAAA,EAAQ,gBAAA;EA2GuC;;;;EA9F3D,OAAA,CAAQ,SAAA,oBAA6B,aAAA;EAbzB;;;;EA6DZ,OAAA,CAAQ,SAAA,EAAW,aAAA;EAAA;;;;EAqCnB,aAAA,kBAAA,CAAgC,GAAA,EAAK,CAAA;EAAL;;;;EAShC,aAAA,kBAAA,CAAgC,eAAA,WAA0B,CAAA;EAU1D;;;;EAAA,IAAA,CAAK,KAAA;EAgBoB;;;;EARzB,aAAA,CAAc,MAAA;;;;;SAQP,iBAAA,CAAkB,GAAA;;;;;SAwBlB,iBAAA,CAAA;AAAA"}

package/dist/services/credentials/encryption.service.js

@@ -0,0 +1,119 @@
+import crypto from "crypto";
+//#region src/services/credentials/encryption.service.ts
+/**
+* Encryption Service
+*
+* Handles encryption and decryption of sensitive credential data
+* Uses AES-256-GCM for authenticated encryption
+*/
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 16;
+const SALT_LENGTH = 32;
+var EncryptionService = class {
+	masterKey;
+	constructor(config) {
+		if (!config.masterKey) throw new Error("Master encryption key is required");
+		this.masterKey = Buffer.from(config.masterKey, "utf-8");
+	}
+	/**
+	* Encrypt data using AES-256-GCM
+	* Returns an object with ciphertext, IV, auth tag, and salt
+	*/
+	encrypt(plaintext) {
+		try {
+			const plaintextString = typeof plaintext === "string" ? plaintext : JSON.stringify(plaintext);
+			const salt = crypto.randomBytes(SALT_LENGTH);
+			const key = crypto.pbkdf2Sync(this.masterKey, salt, 1e5, 32, "sha256");
+			const iv = crypto.randomBytes(IV_LENGTH);
+			const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+			let ciphertext = cipher.update(plaintextString, "utf8", "base64");
+			ciphertext += cipher.final("base64");
+			const authTag = cipher.getAuthTag();
+			return {
+				ciphertext,
+				iv: iv.toString("base64"),
+				authTag: authTag.toString("base64"),
+				salt: salt.toString("base64"),
+				algorithm: ALGORITHM
+			};
+		} catch (error) {
+			throw new Error(`Encryption failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+		}
+	}
+	/**
+	* Decrypt data that was encrypted with encrypt()
+	* Returns the original plaintext
+	*/
+	decrypt(encrypted) {
+		try {
+			const { ciphertext, iv, authTag, salt, algorithm } = encrypted;
+			if (algorithm !== ALGORITHM) throw new Error(`Unsupported algorithm: ${algorithm}`);
+			const ivBuffer = Buffer.from(iv, "base64");
+			const authTagBuffer = Buffer.from(authTag, "base64");
+			const saltBuffer = Buffer.from(salt, "base64");
+			const key = crypto.pbkdf2Sync(this.masterKey, saltBuffer, 1e5, 32, "sha256");
+			const decipher = crypto.createDecipheriv(ALGORITHM, key, ivBuffer);
+			decipher.setAuthTag(authTagBuffer);
+			let plaintext = decipher.update(ciphertext, "base64", "utf8");
+			plaintext += decipher.final("utf8");
+			return plaintext;
+		} catch (error) {
+			throw new Error(`Decryption failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+		}
+	}
+	/**
+	* Encrypt an object and return as an encrypted string
+	* Useful for storing in database
+	*/
+	encryptObject(obj) {
+		const encrypted = this.encrypt(obj);
+		return JSON.stringify(encrypted);
+	}
+	/**
+	* Decrypt a string that was encrypted with encryptObject()
+	* Returns the original object
+	*/
+	decryptObject(encryptedString) {
+		const encrypted = JSON.parse(encryptedString);
+		const decrypted = this.decrypt(encrypted);
+		return JSON.parse(decrypted);
+	}
+	/**
+	* Hash a value using SHA-256
+	* Useful for creating searchable hashes of sensitive data
+	*/
+	hash(value) {
+		return crypto.createHash("sha256").update(value).digest("hex");
+	}
+	/**
+	* Generate a cryptographically secure random token
+	* Useful for API keys, tokens, etc.
+	*/
+	generateToken(length = 32) {
+		return crypto.randomBytes(length).toString("hex");
+	}
+	/**
+	* Validate encryption key strength
+	* Returns true if the key meets minimum security requirements
+	*/
+	static validateMasterKey(key) {
+		if (key.length < 32) return false;
+		return [
+			/[A-Z]/.test(key),
+			/[a-z]/.test(key),
+			/[0-9]/.test(key),
+			/[^A-Za-z0-9]/.test(key)
+		].filter(Boolean).length >= 3;
+	}
+	/**
+	* Generate a new master key
+	* Should be stored securely (e.g., in environment variable or secret manager)
+	*/
+	static generateMasterKey() {
+		return crypto.randomBytes(32).toString("base64");
+	}
+};
+//#endregion
+export { EncryptionService };
+
+//# sourceMappingURL=encryption.service.js.map

package/dist/services/credentials/encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.js","names":[],"sources":["../../../src/services/credentials/encryption.service.ts"],"sourcesContent":["/**\n * Encryption Service\n *\n * Handles encryption and decryption of sensitive credential data\n * Uses AES-256-GCM for authenticated encryption\n */\n\nimport crypto from 'crypto';\n\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 16;\nconst SALT_LENGTH = 32;\n\nexport interface EncryptionConfig {\n  /** Master encryption key (should be loaded from environment variable) */\n  masterKey: string;\n}\n\nexport interface EncryptedData {\n  /** Encrypted data as base64 string */\n  ciphertext: string;\n  /** Initialization vector as base64 string */\n  iv: string;\n  /** Authentication tag as base64 string */\n  authTag: string;\n  /** Salt used for key derivation as base64 string */\n  salt: string;\n  /** Algorithm used */\n  algorithm: string;\n}\n\nexport class EncryptionService {\n  private masterKey: Buffer;\n\n  constructor(config: EncryptionConfig) {\n    if (!config.masterKey) {\n      throw new Error('Master encryption key is required');\n    }\n\n    // Store the master key as a buffer\n    this.masterKey = Buffer.from(config.masterKey, 'utf-8');\n  }\n\n  /**\n   * Encrypt data using AES-256-GCM\n   * Returns an object with ciphertext, IV, auth tag, and salt\n   */\n  encrypt(plaintext: string | object): EncryptedData {\n    try {\n      // Convert object to string if needed\n      const plaintextString = typeof plaintext === 'string' ? plaintext : JSON.stringify(plaintext);\n\n      // Generate a random salt for key derivation\n      const salt = crypto.randomBytes(SALT_LENGTH);\n\n      // Derive a key from the master key and salt using PBKDF2\n      const key = crypto.pbkdf2Sync(\n        this.masterKey,\n        salt,\n        100000, // iterations\n        32, // key length in bytes (256 bits)\n        'sha256',\n      );\n\n      // Generate a random initialization vector\n      const iv = crypto.randomBytes(IV_LENGTH);\n\n      // Create cipher\n      const cipher = crypto.createCipheriv(ALGORITHM, key, iv);\n\n      // Encrypt the data\n      let ciphertext = cipher.update(plaintextString, 'utf8', 'base64');\n      ciphertext += cipher.final('base64');\n\n      // Get the authentication tag\n      const authTag = cipher.getAuthTag();\n\n      return {\n        ciphertext,\n        iv: iv.toString('base64'),\n        authTag: authTag.toString('base64'),\n        salt: salt.toString('base64'),\n        algorithm: ALGORITHM,\n      };\n    } catch (error) {\n      throw new Error(\n        `Encryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`,\n      );\n    }\n  }\n\n  /**\n   * Decrypt data that was encrypted with encrypt()\n   * Returns the original plaintext\n   */\n  decrypt(encrypted: EncryptedData): string {\n    try {\n      // Parse the encrypted data\n      const { ciphertext, iv, authTag, salt, algorithm } = encrypted;\n\n      if (algorithm !== ALGORITHM) {\n        throw new Error(`Unsupported algorithm: ${algorithm}`);\n      }\n\n      // Convert base64 strings back to buffers\n      const ivBuffer = Buffer.from(iv, 'base64');\n      const authTagBuffer = Buffer.from(authTag, 'base64');\n      const saltBuffer = Buffer.from(salt, 'base64');\n\n      // Derive the same key using the stored salt\n      const key = crypto.pbkdf2Sync(this.masterKey, saltBuffer, 100000, 32, 'sha256');\n\n      // Create decipher\n      const decipher = crypto.createDecipheriv(ALGORITHM, key, ivBuffer);\n      decipher.setAuthTag(authTagBuffer);\n\n      // Decrypt the data\n      let plaintext = decipher.update(ciphertext, 'base64', 'utf8');\n      plaintext += decipher.final('utf8');\n\n      return plaintext;\n    } catch (error) {\n      throw new Error(\n        `Decryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`,\n      );\n    }\n  }\n\n  /**\n   * Encrypt an object and return as an encrypted string\n   * Useful for storing in database\n   */\n  encryptObject<T extends object>(obj: T): string {\n    const encrypted = this.encrypt(obj);\n    return JSON.stringify(encrypted);\n  }\n\n  /**\n   * Decrypt a string that was encrypted with encryptObject()\n   * Returns the original object\n   */\n  decryptObject<T extends object>(encryptedString: string): T {\n    const encrypted = JSON.parse(encryptedString) as EncryptedData;\n    const decrypted = this.decrypt(encrypted);\n    return JSON.parse(decrypted) as T;\n  }\n\n  /**\n   * Hash a value using SHA-256\n   * Useful for creating searchable hashes of sensitive data\n   */\n  hash(value: string): string {\n    return crypto.createHash('sha256').update(value).digest('hex');\n  }\n\n  /**\n   * Generate a cryptographically secure random token\n   * Useful for API keys, tokens, etc.\n   */\n  generateToken(length: number = 32): string {\n    return crypto.randomBytes(length).toString('hex');\n  }\n\n  /**\n   * Validate encryption key strength\n   * Returns true if the key meets minimum security requirements\n   */\n  static validateMasterKey(key: string): boolean {\n    // Minimum 32 characters (256 bits)\n    if (key.length < 32) {\n      return false;\n    }\n\n    // Should contain mix of characters\n    const hasUpperCase = /[A-Z]/.test(key);\n    const hasLowerCase = /[a-z]/.test(key);\n    const hasNumbers = /[0-9]/.test(key);\n    const hasSpecial = /[^A-Za-z0-9]/.test(key);\n\n    // Require at least 3 of the 4 character types\n    const characterTypes = [hasUpperCase, hasLowerCase, hasNumbers, hasSpecial].filter(\n      Boolean,\n    ).length;\n\n    return characterTypes >= 3;\n  }\n\n  /**\n   * Generate a new master key\n   * Should be stored securely (e.g., in environment variable or secret manager)\n   */\n  static generateMasterKey(): string {\n    return crypto.randomBytes(32).toString('base64');\n  }\n}\n\n/**\n * Factory function to create encryption service from environment\n */\nexport function createEncryptionService(): EncryptionService {\n  const masterKey = process.env.INVECT_ENCRYPTION_KEY;\n\n  if (!masterKey) {\n    throw new Error(\n      'INVECT_ENCRYPTION_KEY environment variable is required. ' +\n        \"Generate one with: node -e \\\"console.log(require('crypto').randomBytes(32).toString('base64'))\\\"\",\n    );\n  }\n\n  if (!EncryptionService.validateMasterKey(masterKey)) {\n    // Warn about weak encryption key (in production, should throw error)\n    throw new Error(\n      'Encryption key does not meet security requirements. ' +\n        'It should be at least 32 characters and contain a mix of character types.',\n    );\n  }\n\n  return new EncryptionService({ masterKey });\n}\n"],"mappings":";;;;;;;;AASA,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,cAAc;AAoBpB,IAAa,oBAAb,MAA+B;CAC7B;CAEA,YAAY,QAA0B;AACpC,MAAI,CAAC,OAAO,UACV,OAAM,IAAI,MAAM,oCAAoC;AAItD,OAAK,YAAY,OAAO,KAAK,OAAO,WAAW,QAAQ;;;;;;CAOzD,QAAQ,WAA2C;AACjD,MAAI;GAEF,MAAM,kBAAkB,OAAO,cAAc,WAAW,YAAY,KAAK,UAAU,UAAU;GAG7F,MAAM,OAAO,OAAO,YAAY,YAAY;GAG5C,MAAM,MAAM,OAAO,WACjB,KAAK,WACL,MACA,KACA,IACA,SACD;GAGD,MAAM,KAAK,OAAO,YAAY,UAAU;GAGxC,MAAM,SAAS,OAAO,eAAe,WAAW,KAAK,GAAG;GAGxD,IAAI,aAAa,OAAO,OAAO,iBAAiB,QAAQ,SAAS;AACjE,iBAAc,OAAO,MAAM,SAAS;GAGpC,MAAM,UAAU,OAAO,YAAY;AAEnC,UAAO;IACL;IACA,IAAI,GAAG,SAAS,SAAS;IACzB,SAAS,QAAQ,SAAS,SAAS;IACnC,MAAM,KAAK,SAAS,SAAS;IAC7B,WAAW;IACZ;WACM,OAAO;AACd,SAAM,IAAI,MACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,kBAChE;;;;;;;CAQL,QAAQ,WAAkC;AACxC,MAAI;GAEF,MAAM,EAAE,YAAY,IAAI,SAAS,MAAM,cAAc;AAErD,OAAI,cAAc,UAChB,OAAM,IAAI,MAAM,0BAA0B,YAAY;GAIxD,MAAM,WAAW,OAAO,KAAK,IAAI,SAAS;GAC1C,MAAM,gBAAgB,OAAO,KAAK,SAAS,SAAS;GACpD,MAAM,aAAa,OAAO,KAAK,MAAM,SAAS;GAG9C,MAAM,MAAM,OAAO,WAAW,KAAK,WAAW,YAAY,KAAQ,IAAI,SAAS;GAG/E,MAAM,WAAW,OAAO,iBAAiB,WAAW,KAAK,SAAS;AAClE,YAAS,WAAW,cAAc;GAGlC,IAAI,YAAY,SAAS,OAAO,YAAY,UAAU,OAAO;AAC7D,gBAAa,SAAS,MAAM,OAAO;AAEnC,UAAO;WACA,OAAO;AACd,SAAM,IAAI,MACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,kBAChE;;;;;;;CAQL,cAAgC,KAAgB;EAC9C,MAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,SAAO,KAAK,UAAU,UAAU;;;;;;CAOlC,cAAgC,iBAA4B;EAC1D,MAAM,YAAY,KAAK,MAAM,gBAAgB;EAC7C,MAAM,YAAY,KAAK,QAAQ,UAAU;AACzC,SAAO,KAAK,MAAM,UAAU;;;;;;CAO9B,KAAK,OAAuB;AAC1B,SAAO,OAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;CAOhE,cAAc,SAAiB,IAAY;AACzC,SAAO,OAAO,YAAY,OAAO,CAAC,SAAS,MAAM;;;;;;CAOnD,OAAO,kBAAkB,KAAsB;AAE7C,MAAI,IAAI,SAAS,GACf,QAAO;AAcT,SAJuB;GANF,QAAQ,KAAK,IAAI;GACjB,QAAQ,KAAK,IAAI;GACnB,QAAQ,KAAK,IAAI;GACjB,eAAe,KAAK,IAAI;GAGgC,CAAC,OAC1E,QACD,CAAC,UAEuB;;;;;;CAO3B,OAAO,oBAA4B;AACjC,SAAO,OAAO,YAAY,GAAG,CAAC,SAAS,SAAS"}

package/dist/services/credentials/index.d.cts

@@ -0,0 +1,4 @@
+import { EncryptedData, EncryptionConfig, EncryptionService } from "./encryption.service.cjs";
+import { OAuth2ProviderDefinition } from "./oauth2-providers.cjs";
+import { OAuth2AppConfig, OAuth2PendingState, OAuth2Service, OAuth2StartResult, OAuth2Tokens } from "./oauth2.service.cjs";
+import { CreateCredentialInput, Credential, CredentialFilters, CredentialUsage, CredentialWebhookInfo, CredentialsService, UpdateCredentialInput } from "./credentials.service.cjs";

package/dist/services/credentials/index.d.ts

@@ -0,0 +1,4 @@
+import { EncryptedData, EncryptionConfig, EncryptionService } from "./encryption.service.js";
+import { OAuth2ProviderDefinition } from "./oauth2-providers.js";
+import { OAuth2AppConfig, OAuth2PendingState, OAuth2Service, OAuth2StartResult, OAuth2Tokens } from "./oauth2.service.js";
+import { CreateCredentialInput, Credential, CredentialFilters, CredentialUsage, CredentialWebhookInfo, CredentialsService, UpdateCredentialInput } from "./credentials.service.js";