@nestm/storage 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/artifacts/crypto/dek-cache.js

@@ -1,137 +0,0 @@
-import { createHash } from 'node:crypto';
-import { canonicalJson } from './context.js';
-/** Hard policy bounds for cached plaintext data-encryption keys. */
-export const MAX_DEK_CACHE_ENTRIES = 65_536;
-export const MAX_DEK_CACHE_TTL_MS = 5 * 60_000;
-/**
- * Bounded in-memory LRU of unwrapped DEKs so the sandbox's per-request reads don't turn into a
- * KMS Decrypt per object (ADR-0001 D6.2). Never persisted; cleared on shutdown. Deliberate
- * T4-shaped trade: a compromised runtime could read this cache, but it can already call unwrap.
- *
- * Deviation from the ADR's literal wording, on purpose: the key is a length-prefixed hash of
- * (kid, wdk, ctx), not sha256(wdk) — keying on wdk alone would let a cache hit bypass the very
- * context check (KMS EncryptionContext / local wrap-AAD) that makes header-sourced scope
- * trustworthy. Length prefixes are required because kid may contain NUL and wdk is arbitrary
- * binary; delimiter concatenation would let distinct tuples collide before hashing.
- */
-export class CachingKeyProvider {
-    inner;
-    cache = new Map();
-    inFlight = new Map();
-    max;
-    ttlMs;
-    generation = 0;
-    nextToken = 0;
-    constructor(inner, opts = {}) {
-        this.inner = inner;
-        this.max = opts.max ?? 1024;
-        this.ttlMs = opts.ttlMs ?? MAX_DEK_CACHE_TTL_MS;
-        if (!Number.isSafeInteger(this.max) ||
-            this.max < 1 ||
-            this.max > MAX_DEK_CACHE_ENTRIES) {
-            throw new RangeError(`DEK cache max must be an integer between 1 and ${MAX_DEK_CACHE_ENTRIES}`);
-        }
-        if (!Number.isFinite(this.ttlMs) ||
-            this.ttlMs <= 0 ||
-            this.ttlMs > MAX_DEK_CACHE_TTL_MS) {
-            throw new RangeError(`DEK cache ttlMs must be greater than 0 and at most ${MAX_DEK_CACHE_TTL_MS}`);
-        }
-    }
-    generateDataKey(ctx) {
-        // Writes always mint a fresh DEK (one per object write) — nothing to cache.
-        return this.inner.generateDataKey(ctx);
-    }
-    async unwrapDataKey(wdk, kid, ctx) {
-        const hash = createHash('sha256');
-        for (const part of [
-            Buffer.from(kid, 'utf8'),
-            wdk,
-            Buffer.from(canonicalJson(ctx), 'utf8'),
-        ]) {
-            const length = Buffer.allocUnsafe(8);
-            length.writeBigUInt64BE(BigInt(part.byteLength));
-            hash.update(length).update(part);
-        }
-        const key = hash.digest('hex');
-        const hit = this.cache.get(key);
-        if (hit && hit.expiresAt > Date.now()) {
-            // Refresh recency (Map preserves insertion order — oldest entry is the first key).
-            this.cache.delete(key);
-            this.cache.set(key, hit);
-            return Buffer.from(hit.dek);
-        }
-        if (hit)
-            this.evict(key, hit);
-        const existingFlight = this.inFlight.get(key);
-        if (existingFlight !== undefined &&
-            existingFlight.generation === this.generation) {
-            const dek = await existingFlight.promise;
-            if (existingFlight.generation !== this.generation) {
-                throw new Error('DEK cache was cleared during unwrap');
-            }
-            return Buffer.from(dek);
-        }
-        const generation = this.generation;
-        const flight = {
-            generation,
-            promise: this.loadAndCache(key, wdk, kid, ctx, generation),
-        };
-        this.inFlight.set(key, flight);
-        try {
-            const dek = await flight.promise;
-            if (generation !== this.generation) {
-                throw new Error('DEK cache was cleared during unwrap');
-            }
-            return Buffer.from(dek);
-        }
-        finally {
-            if (this.inFlight.get(key) === flight)
-                this.inFlight.delete(key);
-        }
-    }
-    async loadAndCache(key, wdk, kid, ctx, generation) {
-        const dek = await this.inner.unwrapDataKey(wdk, kid, ctx);
-        if (!Buffer.isBuffer(dek) || dek.length !== 32) {
-            if (Buffer.isBuffer(dek))
-                dek.fill(0);
-            throw new Error('inner key provider returned an invalid 32-byte DEK');
-        }
-        if (generation !== this.generation) {
-            dek.fill(0);
-            throw new Error('DEK cache was cleared during unwrap');
-        }
-        if (this.cache.size >= this.max) {
-            const oldest = this.cache.keys().next().value;
-            if (oldest !== undefined)
-                this.evict(oldest, this.cache.get(oldest));
-        }
-        const token = ++this.nextToken;
-        const timer = setTimeout(() => {
-            const entry = this.cache.get(key);
-            if (entry?.token === token)
-                this.evict(key, entry);
-        }, this.ttlMs);
-        timer.unref?.();
-        this.cache.set(key, {
-            dek,
-            expiresAt: Date.now() + this.ttlMs,
-            timer,
-            token,
-        });
-        return dek;
-    }
-    clear() {
-        for (const [key, entry] of this.cache)
-            this.evict(key, entry);
-        this.generation++;
-        this.inFlight.clear();
-        this.inner.clear();
-    }
-    evict(key, entry) {
-        if (entry !== undefined)
-            clearTimeout(entry.timer);
-        entry?.dek.fill(0);
-        this.cache.delete(key);
-    }
-}
-//# sourceMappingURL=dek-cache.js.map

package/dist/artifacts/crypto/dek-cache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dek-cache.js","sourceRoot":"","sources":["../../../src/artifacts/crypto/dek-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAUnE,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IAoBV,KAAK;IAnBP,KAAK,GAAG,IAAI,GAAG,EAQ7B,CAAC;IACa,QAAQ,GAAG,IAAI,GAAG,EAGhC,CAAC;IACa,GAAG,CAAS;IACZ,KAAK,CAAS;IACvB,UAAU,GAAG,CAAC,CAAC;IACf,SAAS,GAAG,CAAC,CAAC;IAEtB,YACmB,KAAkB,EACnC,IAAI,GAAoB,EAAE;qBADT,KAAK;QAGtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC;QAChD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC;YACZ,IAAI,CAAC,GAAG,GAAG,qBAAqB,EAChC,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,kDAAkD,qBAAqB,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,oBAAoB,EACjC,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,sDAAsD,oBAAoB,EAAE,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe,CAAC,GAAoB;QAClC,4EAA4E;QAC5E,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,GAAW,EACX,GAAW,EACX,GAAoB;QAEpB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;YACxB,GAAG;YACH,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;SACxC,EAAE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,mFAAmF;YACnF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE9B,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IACE,cAAc,KAAK,SAAS;YAC5B,cAAc,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAC7C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;YACzC,IAAI,cAAc,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,MAAM,GAAG;YACb,UAAU;YACV,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC;SAC3D,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACjC,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAW,EACX,GAAW,EACX,GAAW,EACX,GAAoB,EACpB,UAAkB;QAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;YAClC,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CACX,GAAW,EACX,KAA6D;QAE7D,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF","sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { canonicalJson, type EnvelopeContext } from './context.js';\nimport type { DataKey, KeyProvider } from './key-provider.js';\n\nexport interface DekCacheOptions {\n  /** Max cached unwrapped DEKs (default 1024). */\n  max?: number;\n  /** Entry lifetime; ADR-0001 D6.2 caps this at 5 minutes (the default). */\n  ttlMs?: number;\n}\n\n/** Hard policy bounds for cached plaintext data-encryption keys. */\nexport const MAX_DEK_CACHE_ENTRIES = 65_536;\nexport const MAX_DEK_CACHE_TTL_MS = 5 * 60_000;\n\n/**\n * Bounded in-memory LRU of unwrapped DEKs so the sandbox's per-request reads don't turn into a\n * KMS Decrypt per object (ADR-0001 D6.2). Never persisted; cleared on shutdown. Deliberate\n * T4-shaped trade: a compromised runtime could read this cache, but it can already call unwrap.\n *\n * Deviation from the ADR's literal wording, on purpose: the key is a length-prefixed hash of\n * (kid, wdk, ctx), not sha256(wdk) — keying on wdk alone would let a cache hit bypass the very\n * context check (KMS EncryptionContext / local wrap-AAD) that makes header-sourced scope\n * trustworthy. Length prefixes are required because kid may contain NUL and wdk is arbitrary\n * binary; delimiter concatenation would let distinct tuples collide before hashing.\n */\nexport class CachingKeyProvider implements KeyProvider {\n  private readonly cache = new Map<\n    string,\n    {\n      dek: Buffer;\n      expiresAt: number;\n      timer: ReturnType<typeof setTimeout>;\n      token: number;\n    }\n  >();\n  private readonly inFlight = new Map<\n    string,\n    { generation: number; promise: Promise<Buffer> }\n  >();\n  private readonly max: number;\n  private readonly ttlMs: number;\n  private generation = 0;\n  private nextToken = 0;\n\n  constructor(\n    private readonly inner: KeyProvider,\n    opts: DekCacheOptions = {},\n  ) {\n    this.max = opts.max ?? 1024;\n    this.ttlMs = opts.ttlMs ?? MAX_DEK_CACHE_TTL_MS;\n    if (\n      !Number.isSafeInteger(this.max) ||\n      this.max < 1 ||\n      this.max > MAX_DEK_CACHE_ENTRIES\n    ) {\n      throw new RangeError(\n        `DEK cache max must be an integer between 1 and ${MAX_DEK_CACHE_ENTRIES}`,\n      );\n    }\n    if (\n      !Number.isFinite(this.ttlMs) ||\n      this.ttlMs <= 0 ||\n      this.ttlMs > MAX_DEK_CACHE_TTL_MS\n    ) {\n      throw new RangeError(\n        `DEK cache ttlMs must be greater than 0 and at most ${MAX_DEK_CACHE_TTL_MS}`,\n      );\n    }\n  }\n\n  generateDataKey(ctx: EnvelopeContext): Promise<DataKey> {\n    // Writes always mint a fresh DEK (one per object write) — nothing to cache.\n    return this.inner.generateDataKey(ctx);\n  }\n\n  async unwrapDataKey(\n    wdk: Buffer,\n    kid: string,\n    ctx: EnvelopeContext,\n  ): Promise<Buffer> {\n    const hash = createHash('sha256');\n    for (const part of [\n      Buffer.from(kid, 'utf8'),\n      wdk,\n      Buffer.from(canonicalJson(ctx), 'utf8'),\n    ]) {\n      const length = Buffer.allocUnsafe(8);\n      length.writeBigUInt64BE(BigInt(part.byteLength));\n      hash.update(length).update(part);\n    }\n    const key = hash.digest('hex');\n    const hit = this.cache.get(key);\n    if (hit && hit.expiresAt > Date.now()) {\n      // Refresh recency (Map preserves insertion order — oldest entry is the first key).\n      this.cache.delete(key);\n      this.cache.set(key, hit);\n      return Buffer.from(hit.dek);\n    }\n    if (hit) this.evict(key, hit);\n\n    const existingFlight = this.inFlight.get(key);\n    if (\n      existingFlight !== undefined &&\n      existingFlight.generation === this.generation\n    ) {\n      const dek = await existingFlight.promise;\n      if (existingFlight.generation !== this.generation) {\n        throw new Error('DEK cache was cleared during unwrap');\n      }\n      return Buffer.from(dek);\n    }\n\n    const generation = this.generation;\n    const flight = {\n      generation,\n      promise: this.loadAndCache(key, wdk, kid, ctx, generation),\n    };\n    this.inFlight.set(key, flight);\n    try {\n      const dek = await flight.promise;\n      if (generation !== this.generation) {\n        throw new Error('DEK cache was cleared during unwrap');\n      }\n      return Buffer.from(dek);\n    } finally {\n      if (this.inFlight.get(key) === flight) this.inFlight.delete(key);\n    }\n  }\n\n  private async loadAndCache(\n    key: string,\n    wdk: Buffer,\n    kid: string,\n    ctx: EnvelopeContext,\n    generation: number,\n  ): Promise<Buffer> {\n    const dek = await this.inner.unwrapDataKey(wdk, kid, ctx);\n    if (!Buffer.isBuffer(dek) || dek.length !== 32) {\n      if (Buffer.isBuffer(dek)) dek.fill(0);\n      throw new Error('inner key provider returned an invalid 32-byte DEK');\n    }\n    if (generation !== this.generation) {\n      dek.fill(0);\n      throw new Error('DEK cache was cleared during unwrap');\n    }\n    if (this.cache.size >= this.max) {\n      const oldest = this.cache.keys().next().value;\n      if (oldest !== undefined) this.evict(oldest, this.cache.get(oldest));\n    }\n    const token = ++this.nextToken;\n    const timer = setTimeout(() => {\n      const entry = this.cache.get(key);\n      if (entry?.token === token) this.evict(key, entry);\n    }, this.ttlMs);\n    timer.unref?.();\n    this.cache.set(key, {\n      dek,\n      expiresAt: Date.now() + this.ttlMs,\n      timer,\n      token,\n    });\n    return dek;\n  }\n\n  clear(): void {\n    for (const [key, entry] of this.cache) this.evict(key, entry);\n    this.generation++;\n    this.inFlight.clear();\n    this.inner.clear();\n  }\n\n  private evict(\n    key: string,\n    entry?: { dek: Buffer; timer: ReturnType<typeof setTimeout> },\n  ): void {\n    if (entry !== undefined) clearTimeout(entry.timer);\n    entry?.dek.fill(0);\n    this.cache.delete(key);\n  }\n}\n"]}

package/dist/artifacts/crypto/index.d.ts

@@ -1,25 +0,0 @@
-import { type DekCacheOptions } from './dek-cache.js';
-import { type KeyProvider, type KeyProviderConfig } from './key-provider.js';
-export { artifactScope, canonicalJson, orgScope, SCOPE_FROM_HEADER, uploadScope, type EnvelopeContext, type ExpectedContext, } from './context.js';
-export { ENVELOPE_SUPPORTED_VERSIONS, ENVELOPE_WRITE_VERSION, ENVELOPE_MAX_OVERHEAD_BYTES, EnvelopeError, isEnvelope, open, seal, type EnvelopeFailureReason, type OpenOptions, type OpenResult, } from './codec.js';
-export { CachingKeyProvider, type DekCacheOptions } from './dek-cache.js';
-export { KEK_GENERATE_HINT, keyProviderConfigFromEnv, type DataKey, type KeyProvider, type KeyProviderConfig, } from './key-provider.js';
-export { KmsKeyProvider } from './kms-provider.js';
-export { LocalKeyProvider } from './local-provider.js';
-/** Everything a storage backend needs to encrypt/decrypt. Required — there is no plaintext mode. */
-export interface StorageCrypto {
-    keyProvider: KeyProvider;
-    /** SEC-04's migration-window flag; see OpenOptions.allowLegacyPlaintext. Default off. */
-    allowLegacyPlaintext?: boolean;
-}
-/** Build the configured provider wrapped in the process-wide DEK cache (ADR-0001 D6.2). */
-export declare function createKeyProvider(cfg: KeyProviderConfig, opts?: {
-    cache?: DekCacheOptions;
-}): KeyProvider;
-/**
- * One-call env→crypto resolution shared by the api and the sandbox (each constructs storage from
- * env separately; this keeps their validation identical). Throws on misconfiguration — callers
- * fail boot, following the SEC-00 gating pattern.
- */
-export declare function storageCryptoFromEnv(env: NodeJS.ProcessEnv): StorageCrypto;
-//# sourceMappingURL=index.d.ts.map

package/dist/artifacts/crypto/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/artifacts/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,UAAU,EACV,IAAI,EACJ,IAAI,EACJ,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,yFAAyF;IACzF,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,iBAAiB,EACtB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,eAAe,CAAA;CAAE,GACjC,WAAW,CAMb;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,aAAa,CAK1E"}

package/dist/artifacts/crypto/index.js

@@ -1,29 +0,0 @@
-import { CachingKeyProvider } from './dek-cache.js';
-import { keyProviderConfigFromEnv, } from './key-provider.js';
-import { KmsKeyProvider } from './kms-provider.js';
-import { LocalKeyProvider } from './local-provider.js';
-export { artifactScope, canonicalJson, orgScope, SCOPE_FROM_HEADER, uploadScope, } from './context.js';
-export { ENVELOPE_SUPPORTED_VERSIONS, ENVELOPE_WRITE_VERSION, ENVELOPE_MAX_OVERHEAD_BYTES, EnvelopeError, isEnvelope, open, seal, } from './codec.js';
-export { CachingKeyProvider } from './dek-cache.js';
-export { KEK_GENERATE_HINT, keyProviderConfigFromEnv, } from './key-provider.js';
-export { KmsKeyProvider } from './kms-provider.js';
-export { LocalKeyProvider } from './local-provider.js';
-/** Build the configured provider wrapped in the process-wide DEK cache (ADR-0001 D6.2). */
-export function createKeyProvider(cfg, opts) {
-    const inner = cfg.kind === 'kms'
-        ? new KmsKeyProvider(cfg.keyId, cfg.region)
-        : new LocalKeyProvider(cfg.name, cfg.kek);
-    return new CachingKeyProvider(inner, opts?.cache);
-}
-/**
- * One-call env→crypto resolution shared by the api and the sandbox (each constructs storage from
- * env separately; this keeps their validation identical). Throws on misconfiguration — callers
- * fail boot, following the SEC-00 gating pattern.
- */
-export function storageCryptoFromEnv(env) {
-    return {
-        keyProvider: createKeyProvider(keyProviderConfigFromEnv(env)),
-        allowLegacyPlaintext: env.ARTIFACT_ENCRYPTION_READ_LEGACY === 'true',
-    };
-}
-//# sourceMappingURL=index.js.map

package/dist/artifacts/crypto/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/artifacts/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAwB,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,wBAAwB,GAGzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,WAAW,GAGZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,UAAU,EACV,IAAI,EACJ,IAAI,GAIL,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAwB,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GAIzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAC/B,GAAsB,EACtB,IAAkC;IAElC,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,KAAK,KAAK;QAChB,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;QAC3C,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,IAAI,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC7D,oBAAoB,EAAE,GAAG,CAAC,+BAA+B,KAAK,MAAM;KACrE,CAAC;AACJ,CAAC","sourcesContent":["import { CachingKeyProvider, type DekCacheOptions } from './dek-cache.js';\nimport {\n  keyProviderConfigFromEnv,\n  type KeyProvider,\n  type KeyProviderConfig,\n} from './key-provider.js';\nimport { KmsKeyProvider } from './kms-provider.js';\nimport { LocalKeyProvider } from './local-provider.js';\n\nexport {\n  artifactScope,\n  canonicalJson,\n  orgScope,\n  SCOPE_FROM_HEADER,\n  uploadScope,\n  type EnvelopeContext,\n  type ExpectedContext,\n} from './context.js';\nexport {\n  ENVELOPE_SUPPORTED_VERSIONS,\n  ENVELOPE_WRITE_VERSION,\n  ENVELOPE_MAX_OVERHEAD_BYTES,\n  EnvelopeError,\n  isEnvelope,\n  open,\n  seal,\n  type EnvelopeFailureReason,\n  type OpenOptions,\n  type OpenResult,\n} from './codec.js';\nexport { CachingKeyProvider, type DekCacheOptions } from './dek-cache.js';\nexport {\n  KEK_GENERATE_HINT,\n  keyProviderConfigFromEnv,\n  type DataKey,\n  type KeyProvider,\n  type KeyProviderConfig,\n} from './key-provider.js';\nexport { KmsKeyProvider } from './kms-provider.js';\nexport { LocalKeyProvider } from './local-provider.js';\n\n/** Everything a storage backend needs to encrypt/decrypt. Required — there is no plaintext mode. */\nexport interface StorageCrypto {\n  keyProvider: KeyProvider;\n  /** SEC-04's migration-window flag; see OpenOptions.allowLegacyPlaintext. Default off. */\n  allowLegacyPlaintext?: boolean;\n}\n\n/** Build the configured provider wrapped in the process-wide DEK cache (ADR-0001 D6.2). */\nexport function createKeyProvider(\n  cfg: KeyProviderConfig,\n  opts?: { cache?: DekCacheOptions },\n): KeyProvider {\n  const inner =\n    cfg.kind === 'kms'\n      ? new KmsKeyProvider(cfg.keyId, cfg.region)\n      : new LocalKeyProvider(cfg.name, cfg.kek);\n  return new CachingKeyProvider(inner, opts?.cache);\n}\n\n/**\n * One-call env→crypto resolution shared by the api and the sandbox (each constructs storage from\n * env separately; this keeps their validation identical). Throws on misconfiguration — callers\n * fail boot, following the SEC-00 gating pattern.\n */\nexport function storageCryptoFromEnv(env: NodeJS.ProcessEnv): StorageCrypto {\n  return {\n    keyProvider: createKeyProvider(keyProviderConfigFromEnv(env)),\n    allowLegacyPlaintext: env.ARTIFACT_ENCRYPTION_READ_LEGACY === 'true',\n  };\n}\n"]}

package/dist/artifacts/crypto/key-provider.d.ts

@@ -1,44 +0,0 @@
-import type { EnvelopeContext } from './context.js';
-/** A fresh per-object data key: the plaintext DEK plus its wrapped form and the wrapping key id. */
-export interface DataKey {
-    /** 32-byte AES-256 key. Callers own this buffer and must zero it after use. */
-    dek: Buffer;
-    /** The DEK wrapped by the provider's KEK/CMK; safe to persist in the envelope header. */
-    wdk: Buffer;
-    /** Wrapping key identifier (`local:<name>` or the KMS key ARN). */
-    kid: string;
-}
-/**
- * Pluggable wrap/unwrap of per-object DEKs (ADR-0001 D4). Both operations take the full
- * EnvelopeContext and MUST bind it to the wrap (KMS EncryptionContext / local wrap-AAD): that
- * binding is what makes the sandbox's header-sourced `scope` trustworthy — see SCOPE_FROM_HEADER.
- * There is deliberately no `none` implementation; unenveloped writes must not exist.
- */
-export interface KeyProvider {
-    generateDataKey(ctx: EnvelopeContext): Promise<DataKey>;
-    /**
-     * Unwrap a stored DEK. Must reject a `kid` that does not belong to this provider's configured
-     * key — a hostile header can never select the decrypting key. Returns a caller-owned copy.
-     */
-    unwrapDataKey(wdk: Buffer, kid: string, ctx: EnvelopeContext): Promise<Buffer>;
-    /** Drop and zero any cached key material (shutdown hook). */
-    clear(): void;
-}
-export type KeyProviderConfig = {
-    kind: 'local';
-    name: string;
-    kek: Buffer;
-} | {
-    kind: 'kms';
-    keyId: string;
-    region?: string;
-};
-/** One-liner shown wherever a missing/invalid KEK aborts boot. */
-export declare const KEK_GENERATE_HINT = "generate one with: node -e \"console.log(require('node:crypto').randomBytes(32).toString('base64'))\"";
-/**
- * Shared env→config validation for the api and the sandbox (both construct storage from env
- * separately; this is the single source of truth, same role as the S3 both-or-neither rule).
- * Throws on any misconfiguration — boot must fail, never degrade to plaintext (ADR D4).
- */
-export declare function keyProviderConfigFromEnv(env: NodeJS.ProcessEnv): KeyProviderConfig;
-//# sourceMappingURL=key-provider.d.ts.map

package/dist/artifacts/crypto/key-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"key-provider.d.ts","sourceRoot":"","sources":["../../../src/artifacts/crypto/key-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,oGAAoG;AACpG,MAAM,WAAW,OAAO;IACtB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;OAGG;IACH,aAAa,CACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,6DAA6D;IAC7D,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,0GAC2E,CAAC;AAE1G;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,iBAAiB,CAqCnB"}

package/dist/artifacts/crypto/key-provider.js

@@ -1,36 +0,0 @@
-/** One-liner shown wherever a missing/invalid KEK aborts boot. */
-export const KEK_GENERATE_HINT = "generate one with: node -e \"console.log(require('node:crypto').randomBytes(32).toString('base64'))\"";
-/**
- * Shared env→config validation for the api and the sandbox (both construct storage from env
- * separately; this is the single source of truth, same role as the S3 both-or-neither rule).
- * Throws on any misconfiguration — boot must fail, never degrade to plaintext (ADR D4).
- */
-export function keyProviderConfigFromEnv(env) {
-    const provider = env.ARTIFACT_KEY_PROVIDER;
-    if (provider === 'local') {
-        if (!env.ARTIFACT_KEK) {
-            throw new Error(`ARTIFACT_KEY_PROVIDER=local requires ARTIFACT_KEK (base64, 32 bytes); ${KEK_GENERATE_HINT}`);
-        }
-        const kek = Buffer.from(env.ARTIFACT_KEK, 'base64');
-        // Round-trip the decode: Buffer.from(_, "base64") silently tolerates garbage.
-        if (kek.length !== 32 ||
-            kek.toString('base64').replace(/=+$/, '') !==
-                env.ARTIFACT_KEK.replace(/=+$/, '')) {
-            throw new Error(`ARTIFACT_KEK must be exactly 32 random bytes, base64-encoded; ${KEK_GENERATE_HINT}`);
-        }
-        return { kind: 'local', name: env.ARTIFACT_KEK_NAME || 'default', kek };
-    }
-    if (provider === 'kms') {
-        if (!env.ARTIFACT_KMS_KEY_ID) {
-            throw new Error('ARTIFACT_KEY_PROVIDER=kms requires ARTIFACT_KMS_KEY_ID (KMS key id, ARN, or alias)');
-        }
-        const region = env.ARTIFACT_KMS_REGION || env.S3_REGION;
-        return {
-            kind: 'kms',
-            keyId: env.ARTIFACT_KMS_KEY_ID,
-            ...(region === undefined ? {} : { region }),
-        };
-    }
-    throw new Error('ARTIFACT_KEY_PROVIDER must be "local" or "kms" — artifact storage is always encrypted and has no plaintext mode (ADR-0001)');
-}
-//# sourceMappingURL=key-provider.js.map

package/dist/artifacts/crypto/key-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"key-provider.js","sourceRoot":"","sources":["../../../src/artifacts/crypto/key-provider.ts"],"names":[],"mappings":"AAqCA,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,uGAAuG,CAAC;AAE1G;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAsB;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yEAAyE,iBAAiB,EAAE,CAC7F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpD,8EAA8E;QAC9E,IACE,GAAG,CAAC,MAAM,KAAK,EAAE;YACjB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iEAAiE,iBAAiB,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,iBAAiB,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,SAAS,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,GAAG,CAAC,mBAAmB;YAC9B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;AACJ,CAAC","sourcesContent":["import type { EnvelopeContext } from './context.js';\n\n/** A fresh per-object data key: the plaintext DEK plus its wrapped form and the wrapping key id. */\nexport interface DataKey {\n  /** 32-byte AES-256 key. Callers own this buffer and must zero it after use. */\n  dek: Buffer;\n  /** The DEK wrapped by the provider's KEK/CMK; safe to persist in the envelope header. */\n  wdk: Buffer;\n  /** Wrapping key identifier (`local:<name>` or the KMS key ARN). */\n  kid: string;\n}\n\n/**\n * Pluggable wrap/unwrap of per-object DEKs (ADR-0001 D4). Both operations take the full\n * EnvelopeContext and MUST bind it to the wrap (KMS EncryptionContext / local wrap-AAD): that\n * binding is what makes the sandbox's header-sourced `scope` trustworthy — see SCOPE_FROM_HEADER.\n * There is deliberately no `none` implementation; unenveloped writes must not exist.\n */\nexport interface KeyProvider {\n  generateDataKey(ctx: EnvelopeContext): Promise<DataKey>;\n  /**\n   * Unwrap a stored DEK. Must reject a `kid` that does not belong to this provider's configured\n   * key — a hostile header can never select the decrypting key. Returns a caller-owned copy.\n   */\n  unwrapDataKey(\n    wdk: Buffer,\n    kid: string,\n    ctx: EnvelopeContext,\n  ): Promise<Buffer>;\n  /** Drop and zero any cached key material (shutdown hook). */\n  clear(): void;\n}\n\nexport type KeyProviderConfig =\n  | { kind: 'local'; name: string; kek: Buffer }\n  | { kind: 'kms'; keyId: string; region?: string };\n\n/** One-liner shown wherever a missing/invalid KEK aborts boot. */\nexport const KEK_GENERATE_HINT =\n  \"generate one with: node -e \\\"console.log(require('node:crypto').randomBytes(32).toString('base64'))\\\"\";\n\n/**\n * Shared env→config validation for the api and the sandbox (both construct storage from env\n * separately; this is the single source of truth, same role as the S3 both-or-neither rule).\n * Throws on any misconfiguration — boot must fail, never degrade to plaintext (ADR D4).\n */\nexport function keyProviderConfigFromEnv(\n  env: NodeJS.ProcessEnv,\n): KeyProviderConfig {\n  const provider = env.ARTIFACT_KEY_PROVIDER;\n  if (provider === 'local') {\n    if (!env.ARTIFACT_KEK) {\n      throw new Error(\n        `ARTIFACT_KEY_PROVIDER=local requires ARTIFACT_KEK (base64, 32 bytes); ${KEK_GENERATE_HINT}`,\n      );\n    }\n    const kek = Buffer.from(env.ARTIFACT_KEK, 'base64');\n    // Round-trip the decode: Buffer.from(_, \"base64\") silently tolerates garbage.\n    if (\n      kek.length !== 32 ||\n      kek.toString('base64').replace(/=+$/, '') !==\n        env.ARTIFACT_KEK.replace(/=+$/, '')\n    ) {\n      throw new Error(\n        `ARTIFACT_KEK must be exactly 32 random bytes, base64-encoded; ${KEK_GENERATE_HINT}`,\n      );\n    }\n    return { kind: 'local', name: env.ARTIFACT_KEK_NAME || 'default', kek };\n  }\n  if (provider === 'kms') {\n    if (!env.ARTIFACT_KMS_KEY_ID) {\n      throw new Error(\n        'ARTIFACT_KEY_PROVIDER=kms requires ARTIFACT_KMS_KEY_ID (KMS key id, ARN, or alias)',\n      );\n    }\n    const region = env.ARTIFACT_KMS_REGION || env.S3_REGION;\n    return {\n      kind: 'kms',\n      keyId: env.ARTIFACT_KMS_KEY_ID,\n      ...(region === undefined ? {} : { region }),\n    };\n  }\n  throw new Error(\n    'ARTIFACT_KEY_PROVIDER must be \"local\" or \"kms\" — artifact storage is always encrypted and has no plaintext mode (ADR-0001)',\n  );\n}\n"]}

package/dist/artifacts/crypto/kms-provider.d.ts

@@ -1,16 +0,0 @@
-import type { EnvelopeContext } from './context.js';
-import type { DataKey, KeyProvider } from './key-provider.js';
-/**
- * AWS KMS provider for deployed environments (ADR-0001 D4). Uses the SDK default credential
- * chain (ECS task role), like the S3 backend. Requires SEC-02's CMK and task-role grants:
- * api — GenerateDataKey/Decrypt/ReEncrypt*; sandbox — Decrypt only.
- */
-export declare class KmsKeyProvider implements KeyProvider {
-    private readonly keyId;
-    private readonly client;
-    constructor(keyId: string, region?: string);
-    generateDataKey(ctx: EnvelopeContext): Promise<DataKey>;
-    unwrapDataKey(wdk: Buffer, kid: string, ctx: EnvelopeContext): Promise<Buffer>;
-    clear(): void;
-}
-//# sourceMappingURL=kms-provider.d.ts.map

package/dist/artifacts/crypto/kms-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kms-provider.d.ts","sourceRoot":"","sources":["../../../src/artifacts/crypto/kms-provider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAiC9D;;;;GAIG;AACH,qBAAa,cAAe,YAAW,WAAW;IAI9C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IAEnC,YACmB,KAAK,EAAE,MAAM,EAC9B,MAAM,CAAC,EAAE,MAAM,EAGhB;IAEK,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB5D;IAEK,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,MAAM,CAAC,CAyBjB;IAED,KAAK,IAAI,IAAI,CAEZ;CACF"}

package/dist/artifacts/crypto/kms-provider.js

@@ -1,90 +0,0 @@
-import { DecryptCommand, GenerateDataKeyCommand, KMSClient, } from '@aws-sdk/client-kms';
-/**
- * KMS EncryptionContext for the wrap (ADR-0001 D3): `{scope, artifactId}` — so CloudTrail
- * records which tenant's which artifact every decrypt serves, and a wrapped DEK cannot be
- * unwrapped under a different claimed context. KMS context values must be strings, so a null
- * artifactId (ObjectStore objects) is omitted rather than stringified.
- */
-function encryptionContext(ctx) {
-    return ctx.artifactId === null
-        ? { scope: ctx.scope }
-        : { scope: ctx.scope, artifactId: ctx.artifactId };
-}
-function equivalentKmsKeyId(headerKid, resolvedKeyId) {
-    if (headerKid === resolvedKeyId)
-        return true;
-    // Multi-Region replicas share the same `mrk-…` resource id but have region-specific ARNs.
-    // Treat those replicas as one logical CMK only when partition and account also match.
-    const parseMrk = (value) => {
-        const match = /^arn:([^:]+):kms:[^:]+:([^:]+):key\/(mrk-[A-Za-z0-9-]+)$/.exec(value);
-        return match === null ? null : [match[1], match[2], match[3]];
-    };
-    const header = parseMrk(headerKid);
-    const resolved = parseMrk(resolvedKeyId);
-    return (header !== null &&
-        resolved !== null &&
-        header.every((part, index) => part === resolved[index]));
-}
-/**
- * AWS KMS provider for deployed environments (ADR-0001 D4). Uses the SDK default credential
- * chain (ECS task role), like the S3 backend. Requires SEC-02's CMK and task-role grants:
- * api — GenerateDataKey/Decrypt/ReEncrypt*; sandbox — Decrypt only.
- */
-export class KmsKeyProvider {
-    keyId;
-    client;
-    constructor(keyId, region) {
-        this.keyId = keyId;
-        this.client = new KMSClient(region ? { region } : {});
-    }
-    async generateDataKey(ctx) {
-        const out = await this.client.send(new GenerateDataKeyCommand({
-            KeyId: this.keyId,
-            KeySpec: 'AES_256',
-            EncryptionContext: encryptionContext(ctx),
-        }));
-        if (!out.Plaintext || !out.CiphertextBlob || !out.KeyId) {
-            out.Plaintext?.fill(0);
-            throw new Error('KMS GenerateDataKey returned an incomplete response');
-        }
-        // kid is the resolved key ARN (not the configured alias) so envelopes are self-describing
-        // for SEC-04's rewrap tooling.
-        try {
-            return {
-                dek: Buffer.from(out.Plaintext),
-                wdk: Buffer.from(out.CiphertextBlob),
-                kid: out.KeyId,
-            };
-        }
-        finally {
-            out.Plaintext.fill(0);
-        }
-    }
-    async unwrapDataKey(wdk, kid, ctx) {
-        // The header kid is attacker-influenced and is deliberately NOT passed to KMS: Decrypt is
-        // pinned to the configured key, so KMS itself rejects ciphertext wrapped under any other key
-        // (a stricter guarantee than string-comparing kid, which may be an alias vs the ARN).
-        const out = await this.client.send(new DecryptCommand({
-            KeyId: this.keyId,
-            CiphertextBlob: wdk,
-            EncryptionContext: encryptionContext(ctx),
-        }));
-        if (!out.Plaintext || !out.KeyId) {
-            out.Plaintext?.fill(0);
-            throw new Error('KMS Decrypt returned an incomplete response');
-        }
-        try {
-            if (!equivalentKmsKeyId(kid, out.KeyId)) {
-                throw new Error('KMS Decrypt resolved a key that does not match the envelope');
-            }
-            return Buffer.from(out.Plaintext);
-        }
-        finally {
-            out.Plaintext.fill(0);
-        }
-    }
-    clear() {
-        this.client.destroy();
-    }
-}
-//# sourceMappingURL=kms-provider.js.map

package/dist/artifacts/crypto/kms-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kms-provider.js","sourceRoot":"","sources":["../../../src/artifacts/crypto/kms-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAK7B;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI;QAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;QACtB,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,aAAqB;IAClE,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAE7C,0FAA0F;IAC1F,sFAAsF;IACtF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAmC,EAAE;QAClE,MAAM,KAAK,GACT,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACzC,OAAO,CACL,MAAM,KAAK,IAAI;QACf,QAAQ,KAAK,IAAI;QACjB,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAIN,KAAK;IAHP,MAAM,CAAY;IAEnC,YACmB,KAAa,EAC9B,MAAe;qBADE,KAAK;QAGtB,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAoB;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAChC,IAAI,sBAAsB,CAAC;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,SAAS;YAClB,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC;SAC1C,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,0FAA0F;QAC1F,+BAA+B;QAC/B,IAAI,CAAC;YACH,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC/B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;gBACpC,GAAG,EAAE,GAAG,CAAC,KAAK;aACf,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,GAAW,EACX,GAAW,EACX,GAAoB;QAEpB,0FAA0F;QAC1F,6FAA6F;QAC7F,sFAAsF;QACtF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAChC,IAAI,cAAc,CAAC;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,GAAG;YACnB,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC;SAC1C,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;CACF","sourcesContent":["import {\n  DecryptCommand,\n  GenerateDataKeyCommand,\n  KMSClient,\n} from '@aws-sdk/client-kms';\n\nimport type { EnvelopeContext } from './context.js';\nimport type { DataKey, KeyProvider } from './key-provider.js';\n\n/**\n * KMS EncryptionContext for the wrap (ADR-0001 D3): `{scope, artifactId}` — so CloudTrail\n * records which tenant's which artifact every decrypt serves, and a wrapped DEK cannot be\n * unwrapped under a different claimed context. KMS context values must be strings, so a null\n * artifactId (ObjectStore objects) is omitted rather than stringified.\n */\nfunction encryptionContext(ctx: EnvelopeContext): Record<string, string> {\n  return ctx.artifactId === null\n    ? { scope: ctx.scope }\n    : { scope: ctx.scope, artifactId: ctx.artifactId };\n}\n\nfunction equivalentKmsKeyId(headerKid: string, resolvedKeyId: string): boolean {\n  if (headerKid === resolvedKeyId) return true;\n\n  // Multi-Region replicas share the same `mrk-…` resource id but have region-specific ARNs.\n  // Treat those replicas as one logical CMK only when partition and account also match.\n  const parseMrk = (value: string): [string, string, string] | null => {\n    const match =\n      /^arn:([^:]+):kms:[^:]+:([^:]+):key\\/(mrk-[A-Za-z0-9-]+)$/.exec(value);\n    return match === null ? null : [match[1]!, match[2]!, match[3]!];\n  };\n  const header = parseMrk(headerKid);\n  const resolved = parseMrk(resolvedKeyId);\n  return (\n    header !== null &&\n    resolved !== null &&\n    header.every((part, index) => part === resolved[index])\n  );\n}\n\n/**\n * AWS KMS provider for deployed environments (ADR-0001 D4). Uses the SDK default credential\n * chain (ECS task role), like the S3 backend. Requires SEC-02's CMK and task-role grants:\n * api — GenerateDataKey/Decrypt/ReEncrypt*; sandbox — Decrypt only.\n */\nexport class KmsKeyProvider implements KeyProvider {\n  private readonly client: KMSClient;\n\n  constructor(\n    private readonly keyId: string,\n    region?: string,\n  ) {\n    this.client = new KMSClient(region ? { region } : {});\n  }\n\n  async generateDataKey(ctx: EnvelopeContext): Promise<DataKey> {\n    const out = await this.client.send(\n      new GenerateDataKeyCommand({\n        KeyId: this.keyId,\n        KeySpec: 'AES_256',\n        EncryptionContext: encryptionContext(ctx),\n      }),\n    );\n    if (!out.Plaintext || !out.CiphertextBlob || !out.KeyId) {\n      out.Plaintext?.fill(0);\n      throw new Error('KMS GenerateDataKey returned an incomplete response');\n    }\n    // kid is the resolved key ARN (not the configured alias) so envelopes are self-describing\n    // for SEC-04's rewrap tooling.\n    try {\n      return {\n        dek: Buffer.from(out.Plaintext),\n        wdk: Buffer.from(out.CiphertextBlob),\n        kid: out.KeyId,\n      };\n    } finally {\n      out.Plaintext.fill(0);\n    }\n  }\n\n  async unwrapDataKey(\n    wdk: Buffer,\n    kid: string,\n    ctx: EnvelopeContext,\n  ): Promise<Buffer> {\n    // The header kid is attacker-influenced and is deliberately NOT passed to KMS: Decrypt is\n    // pinned to the configured key, so KMS itself rejects ciphertext wrapped under any other key\n    // (a stricter guarantee than string-comparing kid, which may be an alias vs the ARN).\n    const out = await this.client.send(\n      new DecryptCommand({\n        KeyId: this.keyId,\n        CiphertextBlob: wdk,\n        EncryptionContext: encryptionContext(ctx),\n      }),\n    );\n    if (!out.Plaintext || !out.KeyId) {\n      out.Plaintext?.fill(0);\n      throw new Error('KMS Decrypt returned an incomplete response');\n    }\n    try {\n      if (!equivalentKmsKeyId(kid, out.KeyId)) {\n        throw new Error(\n          'KMS Decrypt resolved a key that does not match the envelope',\n        );\n      }\n      return Buffer.from(out.Plaintext);\n    } finally {\n      out.Plaintext.fill(0);\n    }\n  }\n\n  clear(): void {\n    this.client.destroy();\n  }\n}\n"]}

package/dist/artifacts/crypto/local-provider.d.ts

@@ -1,17 +0,0 @@
-import { type EnvelopeContext } from './context.js';
-import type { DataKey, KeyProvider } from './key-provider.js';
-/**
- * Static-KEK provider for dev, CI, and self-hosted fs deployments (ADR-0001 D4). The wrap is
- * AES-256-GCM with the canonical context as AAD, so a wdk replayed under a different
- * scope/artifact/path fails to unwrap — the same property KMS EncryptionContext gives the `kms`
- * provider, and the property the sandbox's header-sourced scope relies on.
- */
-export declare class LocalKeyProvider implements KeyProvider {
-    private readonly kek;
-    private readonly kid;
-    constructor(name: string, kek: Buffer);
-    generateDataKey(ctx: EnvelopeContext): Promise<DataKey>;
-    unwrapDataKey(wdk: Buffer, kid: string, ctx: EnvelopeContext): Promise<Buffer>;
-    clear(): void;
-}
-//# sourceMappingURL=local-provider.d.ts.map

package/dist/artifacts/crypto/local-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-provider.d.ts","sourceRoot":"","sources":["../../../src/artifacts/crypto/local-provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAO9D;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,WAAW;IAKhD,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YACE,IAAI,EAAE,MAAM,EACK,GAAG,EAAE,MAAM,EAK7B;IAED,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtD;IAED,aAAa,CACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,MAAM,CAAC,CA2BjB;IAED,KAAK,IAAI,IAAI,CAEZ;CACF"}

package/dist/artifacts/crypto/local-provider.js

@@ -1,58 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import { canonicalJson } from './context.js';
-// wdk layout: 12-byte IV ‖ 16-byte GCM tag ‖ 32-byte wrapped DEK.
-const IV_LEN = 12;
-const TAG_LEN = 16;
-const DEK_LEN = 32;
-/**
- * Static-KEK provider for dev, CI, and self-hosted fs deployments (ADR-0001 D4). The wrap is
- * AES-256-GCM with the canonical context as AAD, so a wdk replayed under a different
- * scope/artifact/path fails to unwrap — the same property KMS EncryptionContext gives the `kms`
- * provider, and the property the sandbox's header-sourced scope relies on.
- */
-export class LocalKeyProvider {
-    kek;
-    kid;
-    constructor(name, kek) {
-        this.kek = kek;
-        if (kek.length !== 32)
-            throw new Error('local KEK must be exactly 32 bytes');
-        this.kid = `local:${name}`;
-    }
-    generateDataKey(ctx) {
-        const dek = randomBytes(DEK_LEN);
-        const iv = randomBytes(IV_LEN);
-        const cipher = createCipheriv('aes-256-gcm', this.kek, iv);
-        cipher.setAAD(Buffer.from(canonicalJson(ctx)));
-        const wrapped = Buffer.concat([cipher.update(dek), cipher.final()]);
-        const wdk = Buffer.concat([iv, cipher.getAuthTag(), wrapped]);
-        return Promise.resolve({ dek, wdk, kid: this.kid });
-    }
-    unwrapDataKey(wdk, kid, ctx) {
-        // A hostile header must never select the key: only our own kid is accepted.
-        if (kid !== this.kid) {
-            return Promise.reject(new Error(`unknown key id "${kid}" (configured: "${this.kid}")`));
-        }
-        if (wdk.length !== IV_LEN + TAG_LEN + DEK_LEN) {
-            return Promise.reject(new Error('malformed wrapped data key'));
-        }
-        const iv = wdk.subarray(0, IV_LEN);
-        const tag = wdk.subarray(IV_LEN, IV_LEN + TAG_LEN);
-        const wrapped = wdk.subarray(IV_LEN + TAG_LEN);
-        const decipher = createDecipheriv('aes-256-gcm', this.kek, iv);
-        decipher.setAAD(Buffer.from(canonicalJson(ctx)));
-        decipher.setAuthTag(tag);
-        try {
-            return Promise.resolve(Buffer.concat([decipher.update(wrapped), decipher.final()]));
-        }
-        catch {
-            // GCM cannot distinguish wrong-context from corruption; both are "this key is not
-            // available for this context" — fail closed without detail.
-            return Promise.reject(new Error('wrapped data key failed to unwrap for this context'));
-        }
-    }
-    clear() {
-        // Stateless: the KEK itself must outlive clear() (it is the provider's configuration).
-    }
-}
-//# sourceMappingURL=local-provider.js.map

package/dist/artifacts/crypto/local-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-provider.js","sourceRoot":"","sources":["../../../src/artifacts/crypto/local-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAGnE,kEAAkE;AAClE,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAKR,GAAG;IAJL,GAAG,CAAS;IAE7B,YACE,IAAY,EACK,GAAW;mBAAX,GAAG;QAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YACnB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,GAAG,SAAS,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,eAAe,CAAC,GAAoB;QAClC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,aAAa,CACX,GAAW,EACX,GAAW,EACX,GAAoB;QAEpB,4EAA4E;QAC5E,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,mBAAmB,GAAG,mBAAmB,IAAI,CAAC,GAAG,IAAI,CAAC,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,OAAO,GAAG,OAAO,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CACpB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;YAClF,4DAA4D;YAC5D,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK;QACH,uFAAuF;IACzF,CAAC;CACF","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\n\nimport { canonicalJson, type EnvelopeContext } from './context.js';\nimport type { DataKey, KeyProvider } from './key-provider.js';\n\n// wdk layout: 12-byte IV ‖ 16-byte GCM tag ‖ 32-byte wrapped DEK.\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\nconst DEK_LEN = 32;\n\n/**\n * Static-KEK provider for dev, CI, and self-hosted fs deployments (ADR-0001 D4). The wrap is\n * AES-256-GCM with the canonical context as AAD, so a wdk replayed under a different\n * scope/artifact/path fails to unwrap — the same property KMS EncryptionContext gives the `kms`\n * provider, and the property the sandbox's header-sourced scope relies on.\n */\nexport class LocalKeyProvider implements KeyProvider {\n  private readonly kid: string;\n\n  constructor(\n    name: string,\n    private readonly kek: Buffer,\n  ) {\n    if (kek.length !== 32)\n      throw new Error('local KEK must be exactly 32 bytes');\n    this.kid = `local:${name}`;\n  }\n\n  generateDataKey(ctx: EnvelopeContext): Promise<DataKey> {\n    const dek = randomBytes(DEK_LEN);\n    const iv = randomBytes(IV_LEN);\n    const cipher = createCipheriv('aes-256-gcm', this.kek, iv);\n    cipher.setAAD(Buffer.from(canonicalJson(ctx)));\n    const wrapped = Buffer.concat([cipher.update(dek), cipher.final()]);\n    const wdk = Buffer.concat([iv, cipher.getAuthTag(), wrapped]);\n    return Promise.resolve({ dek, wdk, kid: this.kid });\n  }\n\n  unwrapDataKey(\n    wdk: Buffer,\n    kid: string,\n    ctx: EnvelopeContext,\n  ): Promise<Buffer> {\n    // A hostile header must never select the key: only our own kid is accepted.\n    if (kid !== this.kid) {\n      return Promise.reject(\n        new Error(`unknown key id \"${kid}\" (configured: \"${this.kid}\")`),\n      );\n    }\n    if (wdk.length !== IV_LEN + TAG_LEN + DEK_LEN) {\n      return Promise.reject(new Error('malformed wrapped data key'));\n    }\n    const iv = wdk.subarray(0, IV_LEN);\n    const tag = wdk.subarray(IV_LEN, IV_LEN + TAG_LEN);\n    const wrapped = wdk.subarray(IV_LEN + TAG_LEN);\n    const decipher = createDecipheriv('aes-256-gcm', this.kek, iv);\n    decipher.setAAD(Buffer.from(canonicalJson(ctx)));\n    decipher.setAuthTag(tag);\n    try {\n      return Promise.resolve(\n        Buffer.concat([decipher.update(wrapped), decipher.final()]),\n      );\n    } catch {\n      // GCM cannot distinguish wrong-context from corruption; both are \"this key is not\n      // available for this context\" — fail closed without detail.\n      return Promise.reject(\n        new Error('wrapped data key failed to unwrap for this context'),\n      );\n    }\n  }\n\n  clear(): void {\n    // Stateless: the KEK itself must outlive clear() (it is the provider's configuration).\n  }\n}\n"]}

package/dist/artifacts/env-config.d.ts

@@ -1,15 +0,0 @@
-import { type ArtifactStorageConfig } from './storage-driver.js';
-/**
- * Shared env→storage-config validation for every service that constructs storage (the api's
- * zod-validated env delegates here with normalized values; the sandbox passes process.env
- * directly). One source of truth for the rules — the two services once drifted by
- * re-implementing them independently.
- *
- * `STORAGE_PROVIDER` names any provider `@nestm/storage` can build (`fs`, `s3`, `gcs`, `azure`,
- * `r2`, `minio`, `supabase`, …); the `STORAGE_*` values below are one flat bag that each provider
- * reads what it needs from. The platform is not S3-only: it used to be, because storage shipped
- * exactly two hand-written drivers, and the old `ARTIFACT_STORAGE=fs|s3` switch chose between
- * them. Those names are still accepted so a deployment can migrate without a coordinated restart.
- */
-export declare function artifactStorageConfigFromEnv(env: NodeJS.ProcessEnv): ArtifactStorageConfig;
-//# sourceMappingURL=env-config.d.ts.map

package/dist/artifacts/env-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-config.d.ts","sourceRoot":"","sources":["../../src/artifacts/env-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,qBAAqB,CAuCvB"}