@layer-ai/core 0.6.0 → 0.7.1

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export { authenticate } from './middleware/auth.js';
 export type {} from './middleware/auth.js';
 export { db } from './lib/db/postgres.js';
 export { default as redis } from './lib/db/redis.js';
+export { encrypt, decrypt, generateEncryptionKey } from './lib/encryption.js';
+export type { EncryptedData } from '@layer-ai/sdk';
 export declare const createSessionKey: (userId: string) => Promise<string>;
 export declare const deleteSessionKeysForUser: (userId: string) => Promise<void>;
 export * from './services/task-analysis.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAG3C,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,OAAO,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAGrD,eAAO,MAAM,gBAAgB,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAGrE,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAG3E,CAAC;AAGF,cAAc,6BAA6B,CAAC;AAG5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAG3C,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,OAAO,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,eAAO,MAAM,gBAAgB,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAGrE,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAG3E,CAAC;AAGF,cAAc,6BAA6B,CAAC;AAG5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -9,6 +9,8 @@ export { authenticate } from './middleware/auth.js';
 // Database
 export { db } from './lib/db/postgres.js';
 export { default as redis } from './lib/db/redis.js';
+// Encryption
+export { encrypt, decrypt, generateEncryptionKey } from './lib/encryption.js';
 // Session Key Utilities (for Next.js auth)
 export const createSessionKey = async (userId) => {
     const { db } = await import('./lib/db/postgres.js');

package/dist/lib/db/postgres.d.ts

@@ -1,5 +1,5 @@
 import pg from 'pg';
-import type { User, ApiKey, Gate } from '@layer-ai/sdk';
+import type { User, ApiKey, Gate, ProviderKey } from '@layer-ai/sdk';
 declare function getPool(): pg.Pool;
 export declare const db: {
     query(text: string, params?: any[]): Promise<pg.QueryResult<any>>;
@@ -25,6 +25,21 @@ export declare const db: {
     } | null>;
     createSessionKey(userId: string): Promise<string>;
     deleteSessionKeysForUser(userId: string): Promise<void>;
+    getProviderKey(userId: string, provider: string): Promise<ProviderKey | null>;
+    getProviderKeys(userId: string): Promise<ProviderKey[]>;
+    createProviderKey(userId: string, provider: string, encryptedKey: {
+        encrypted: string;
+        iv: string;
+        authTag: string;
+    }, keyPrefix: string): Promise<ProviderKey>;
+    updateProviderKey(userId: string, provider: string, encryptedKey: {
+        encrypted: string;
+        iv: string;
+        authTag: string;
+    }, keyPrefix: string): Promise<ProviderKey | null>;
+    deleteProviderKey(userId: string, provider: string): Promise<boolean>;
+    hardDeleteProviderKey(userId: string, provider: string): Promise<boolean>;
+    getDeletedProviderKeys(daysOld?: number): Promise<ProviderKey[]>;
 };
 export default getPool;
 //# sourceMappingURL=postgres.d.ts.map

package/dist/lib/db/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/lib/db/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAyB,MAAM,eAAe,CAAC;AAO/E,iBAAS,OAAO,IAAI,EAAE,CAAC,IAAI,CAqB1B;AA0BD,eAAO,MAAM,EAAE;gBAEK,MAAM,WAAW,GAAG,EAAE;0BASZ,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBAQnC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;sBAQ3B,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;6BASrC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;yBAQnC,MAAM,WAAW,MAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;kCAQjE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;8BAO1B,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;qBAQnC,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;iCAS7B,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;+BAQjD,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;4BAQhD,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;uBAQ7B,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;oBA4BpC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;mBAQ9B,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;mBA4CxC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;qBASvB,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;iCAgBP,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;6BAQhE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;qCAehB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM9D,CAAC;AAEF,eAAe,OAAO,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/lib/db/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAyB,WAAW,EAAE,MAAM,eAAe,CAAC;AAO5F,iBAAS,OAAO,IAAI,EAAE,CAAC,IAAI,CAqB1B;AA0BD,eAAO,MAAM,EAAE;gBAEK,MAAM,WAAW,GAAG,EAAE;0BASZ,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBAQnC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;sBAQ3B,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;6BASrC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;yBAQnC,MAAM,WAAW,MAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;kCAQjE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;8BAO1B,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;qBAQnC,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;iCAS7B,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;+BAQjD,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;4BAQhD,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;uBAQ7B,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;oBA4BpC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;mBAQ9B,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;mBA4CxC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;qBASvB,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;iCAgBP,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;6BAQhE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;qCAehB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;2BAQhC,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;4BAQrD,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;8BASnD,MAAM,YACJ,MAAM,gBACF;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,aACrD,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC;8BAWb,MAAM,YACJ,MAAM,gBACF;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,aACrD,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;8BAWE,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;kCAQvC,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;qCAQzC,MAAM,GAAQ,OAAO,CAAC,WAAW,EAAE,CAAC;CAU3E,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/lib/db/postgres.js

@@ -196,6 +196,43 @@ export const db = {
     },
     async deleteSessionKeysForUser(userId) {
         await getPool().query('DELETE FROM session_keys WHERE user_id = $1', [userId]);
-    }
+    },
+    // Provider Keys (BYOK)
+    async getProviderKey(userId, provider) {
+        const result = await getPool().query('SELECT * FROM provider_keys WHERE user_id = $1 AND provider = $2 AND deleted_at IS NULL', [userId, provider]);
+        return result.rows[0] ? toCamelCase(result.rows[0]) : null;
+    },
+    async getProviderKeys(userId) {
+        const result = await getPool().query('SELECT * FROM provider_keys WHERE user_id = $1 AND deleted_at IS NULL ORDER BY created_at DESC', [userId]);
+        return result.rows.map(toCamelCase);
+    },
+    async createProviderKey(userId, provider, encryptedKey, keyPrefix) {
+        const result = await getPool().query(`INSERT INTO provider_keys (user_id, provider, encrypted_key, key_prefix)
+       VALUES ($1, $2, $3, $4)
+       RETURNING *`, [userId, provider, JSON.stringify(encryptedKey), keyPrefix]);
+        return toCamelCase(result.rows[0]);
+    },
+    async updateProviderKey(userId, provider, encryptedKey, keyPrefix) {
+        const result = await getPool().query(`UPDATE provider_keys
+       SET encrypted_key = $3, key_prefix = $4, deleted_at = NULL, updated_at = NOW()
+       WHERE user_id = $1 AND provider = $2
+       RETURNING *`, [userId, provider, JSON.stringify(encryptedKey), keyPrefix]);
+        return result.rows[0] ? toCamelCase(result.rows[0]) : null;
+    },
+    async deleteProviderKey(userId, provider) {
+        const result = await getPool().query('UPDATE provider_keys SET deleted_at = NOW() WHERE user_id = $1 AND provider = $2 AND deleted_at IS NULL', [userId, provider]);
+        return (result.rowCount ?? 0) > 0;
+    },
+    async hardDeleteProviderKey(userId, provider) {
+        const result = await getPool().query('DELETE FROM provider_keys WHERE user_id = $1 AND provider = $2', [userId, provider]);
+        return (result.rowCount ?? 0) > 0;
+    },
+    async getDeletedProviderKeys(daysOld = 90) {
+        const result = await getPool().query(`SELECT * FROM provider_keys
+       WHERE deleted_at IS NOT NULL
+       AND deleted_at < NOW() - INTERVAL '1 day' * $1
+       ORDER BY deleted_at ASC`, [daysOld]);
+        return result.rows.map(toCamelCase);
+    },
 };
 export default getPool;

package/dist/lib/encryption.d.ts

@@ -0,0 +1,9 @@
+export interface EncryptedData {
+    encrypted: string;
+    iv: string;
+    authTag: string;
+}
+export declare function encrypt(plaintext: string, masterKey: string): EncryptedData;
+export declare function decrypt(encryptedData: EncryptedData, masterKey: string): string;
+export declare function generateEncryptionKey(): string;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/lib/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/lib/encryption.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,CAqB3E;AAED,wBAAgB,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAmB/E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}

package/dist/lib/encryption.js

@@ -0,0 +1,39 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+export function encrypt(plaintext, masterKey) {
+    if (!plaintext) {
+        throw new Error("Plaintext is required");
+    }
+    if (!masterKey || masterKey.length !== 64) {
+        throw new Error("Master key must be a 64-character hex string (32 bytes)");
+    }
+    const iv = randomBytes(12);
+    const keyBuffer = Buffer.from(masterKey, "hex");
+    const cipher = createCipheriv("aes-256-gcm", keyBuffer, iv);
+    let encrypted = cipher.update(plaintext, "utf-8", "hex");
+    encrypted += cipher.final("hex");
+    const authTag = cipher.getAuthTag();
+    return {
+        encrypted,
+        iv: iv.toString("hex"),
+        authTag: authTag.toString("hex"),
+    };
+}
+export function decrypt(encryptedData, masterKey) {
+    if (!encryptedData || !encryptedData.encrypted || !encryptedData.iv || !encryptedData.authTag) {
+        throw new Error("Invalid encrypted data structure");
+    }
+    if (!masterKey || masterKey.length !== 64) {
+        throw new Error("Master key must be a 64-character hex string (32 bytes)");
+    }
+    const keyBuffer = Buffer.from(masterKey, "hex");
+    const ivBuffer = Buffer.from(encryptedData.iv, "hex");
+    const authTagBuffer = Buffer.from(encryptedData.authTag, "hex");
+    const decipher = createDecipheriv("aes-256-gcm", keyBuffer, ivBuffer);
+    decipher.setAuthTag(authTagBuffer);
+    let decrypted = decipher.update(encryptedData.encrypted, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+}
+export function generateEncryptionKey() {
+    return randomBytes(32).toString("hex");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layer-ai/core",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Core API routes and services for Layer AI",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,7 +36,7 @@
     "nanoid": "^5.0.4",
     "openai": "^4.24.0",
     "pg": "^8.11.3",
-    "@layer-ai/sdk": "^0.6.0"
+    "@layer-ai/sdk": "^0.7.0"
   },
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",