@nodetool-ai/security 0.7.0-rc.11

package/dist/crypto.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Cryptographic utilities for secret encryption and decryption.
+ *
+ * This module provides utilities for encrypting and decrypting secrets using
+ * AES-256-GCM symmetric encryption with PBKDF2 key derivation.
+ *
+ * The master key is combined with user_id (as salt) to derive user-specific
+ * encryption keys via PBKDF2-SHA256 with 100,000 iterations.
+ */
+/**
+ * Generate a new random master key.
+ *
+ * @returns A base64-encoded 32-byte master key string.
+ */
+export declare function generateMasterKey(): string;
+/**
+ * Derive an encryption key from the master key using user_id as salt.
+ *
+ * This ensures each user's secrets are encrypted with a unique derived key,
+ * providing isolation between users even if the master key is compromised.
+ *
+ * @param masterKey - The master key (base64-encoded or raw string).
+ * @param userId - The user ID to use as salt for key derivation.
+ * @returns A 32-byte derived key as a Buffer.
+ */
+export declare function deriveKey(masterKey: string, userId: string): Buffer;
+/**
+ * Encrypt a plaintext value using AES-256-GCM.
+ *
+ * The output format is: base64(iv || ciphertext || authTag)
+ *
+ * @param masterKey - The master key to use for encryption.
+ * @param userId - The user ID to use as salt for key derivation.
+ * @param plaintext - The plaintext string to encrypt.
+ * @returns The encrypted value as a base64-encoded string.
+ */
+export declare function encrypt(masterKey: string, userId: string, plaintext: string): string;
+/**
+ * Decrypt an encrypted value using AES-256-GCM.
+ *
+ * @param masterKey - The master key to use for decryption.
+ * @param userId - The user ID to use as salt for key derivation.
+ * @param encryptedValue - The encrypted value as a base64-encoded string.
+ * @returns The decrypted plaintext string.
+ * @throws {Error} If the master key is incorrect or the data is corrupted.
+ */
+export declare function decrypt(masterKey: string, userId: string, encryptedValue: string): string;
+/**
+ * Decrypt a Fernet token encrypted by the Python side.
+ *
+ * Python uses: PBKDF2(master_key_bytes, user_id, 100k, 32) → fernet_key
+ * Fernet = AES-128-CBC + HMAC-SHA256, token = base64url(ver|ts|iv|ct|hmac)
+ *
+ * @param masterKey - The master key as a base64 or base64url string.
+ * @param userId - The user ID used as PBKDF2 salt.
+ * @param encryptedValue - The Fernet token (base64url encoded).
+ */
+export declare function decryptFernet(masterKey: string, userId: string, encryptedValue: string): string;
+/**
+ * Encrypt a value using Fernet (Python-compatible).
+ *
+ * Produces a token that Python's cryptography.Fernet can decrypt.
+ * Format: base64url(version(1) | timestamp(8) | iv(16) | ciphertext(N) | hmac(32))
+ *
+ * @param masterKey - The master key as a base64 or utf-8 string.
+ * @param userId - The user ID used as PBKDF2 salt.
+ * @param plaintext - The plaintext to encrypt.
+ */
+export declare function encryptFernet(masterKey: string, userId: string, plaintext: string): string;
+/**
+ * Check if a master key is valid by attempting to decrypt a test value.
+ *
+ * @param masterKey - The master key to validate.
+ * @param testEncryptedValue - An encrypted test value to decrypt.
+ * @param userId - The user ID used as salt for the test value.
+ * @returns True if the master key is valid, false otherwise.
+ */
+export declare function isValidMasterKey(masterKey: string, testEncryptedValue: string, userId: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsBH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CAcR;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CA8BR;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CAiDR;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CA+CR;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAOT"}

package/dist/crypto.js

@@ -0,0 +1,205 @@
+/**
+ * Cryptographic utilities for secret encryption and decryption.
+ *
+ * This module provides utilities for encrypting and decrypting secrets using
+ * AES-256-GCM symmetric encryption with PBKDF2 key derivation.
+ *
+ * The master key is combined with user_id (as salt) to derive user-specific
+ * encryption keys via PBKDF2-SHA256 with 100,000 iterations.
+ */
+import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv, createHmac, timingSafeEqual } from "node:crypto";
+import { createLogger } from "@nodetool-ai/config";
+const log = createLogger("nodetool.security.crypto");
+// Fernet token version byte
+const FERNET_VERSION = 0x80;
+const PBKDF2_ITERATIONS = 100_000;
+const KEY_LENGTH = 32; // 256 bits for AES-256
+const IV_LENGTH = 12; // 96 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+/**
+ * Generate a new random master key.
+ *
+ * @returns A base64-encoded 32-byte master key string.
+ */
+export function generateMasterKey() {
+    return randomBytes(KEY_LENGTH).toString("base64");
+}
+/**
+ * Derive an encryption key from the master key using user_id as salt.
+ *
+ * This ensures each user's secrets are encrypted with a unique derived key,
+ * providing isolation between users even if the master key is compromised.
+ *
+ * @param masterKey - The master key (base64-encoded or raw string).
+ * @param userId - The user ID to use as salt for key derivation.
+ * @returns A 32-byte derived key as a Buffer.
+ */
+export function deriveKey(masterKey, userId) {
+    const salt = Buffer.from(userId, "utf-8");
+    return pbkdf2Sync(masterKey, salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha256");
+}
+/**
+ * Encrypt a plaintext value using AES-256-GCM.
+ *
+ * The output format is: base64(iv || ciphertext || authTag)
+ *
+ * @param masterKey - The master key to use for encryption.
+ * @param userId - The user ID to use as salt for key derivation.
+ * @param plaintext - The plaintext string to encrypt.
+ * @returns The encrypted value as a base64-encoded string.
+ */
+export function encrypt(masterKey, userId, plaintext) {
+    const key = deriveKey(masterKey, userId);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, "utf-8"),
+        cipher.final()
+    ]);
+    const authTag = cipher.getAuthTag();
+    // Pack: iv (12) + ciphertext (variable) + authTag (16)
+    const packed = Buffer.concat([iv, encrypted, authTag]);
+    return packed.toString("base64");
+}
+/**
+ * Decrypt an encrypted value using AES-256-GCM.
+ *
+ * @param masterKey - The master key to use for decryption.
+ * @param userId - The user ID to use as salt for key derivation.
+ * @param encryptedValue - The encrypted value as a base64-encoded string.
+ * @returns The decrypted plaintext string.
+ * @throws {Error} If the master key is incorrect or the data is corrupted.
+ */
+export function decrypt(masterKey, userId, encryptedValue) {
+    const key = deriveKey(masterKey, userId);
+    const packed = Buffer.from(encryptedValue, "base64");
+    if (packed.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+        throw new Error("Failed to decrypt secret: data too short");
+    }
+    const iv = packed.subarray(0, IV_LENGTH);
+    const authTag = packed.subarray(packed.length - AUTH_TAG_LENGTH);
+    const ciphertext = packed.subarray(IV_LENGTH, packed.length - AUTH_TAG_LENGTH);
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final()
+        ]);
+        return decrypted.toString("utf-8");
+    }
+    catch (err) {
+        log.debug("AES-GCM decryption failed (may fall back to Fernet)", {
+            error: String(err)
+        });
+        throw new Error("Failed to decrypt secret");
+    }
+}
+/**
+ * Decrypt a Fernet token encrypted by the Python side.
+ *
+ * Python uses: PBKDF2(master_key_bytes, user_id, 100k, 32) → fernet_key
+ * Fernet = AES-128-CBC + HMAC-SHA256, token = base64url(ver|ts|iv|ct|hmac)
+ *
+ * @param masterKey - The master key as a base64 or base64url string.
+ * @param userId - The user ID used as PBKDF2 salt.
+ * @param encryptedValue - The Fernet token (base64url encoded).
+ */
+export function decryptFernet(masterKey, userId, encryptedValue) {
+    // Python uses master_key.encode() — the UTF-8 bytes of the base64 string itself as PBKDF2 password
+    const masterKeyBytes = Buffer.from(masterKey, "utf-8");
+    const salt = Buffer.from(userId, "utf-8");
+    const derived = pbkdf2Sync(masterKeyBytes, salt, PBKDF2_ITERATIONS, 32, "sha256");
+    // Fernet splits the 32-byte derived key: first 16 = HMAC key, last 16 = AES-128 key
+    const hmacKey = derived.subarray(0, 16);
+    const aesKey = derived.subarray(16, 32);
+    // Decode Fernet token from base64url
+    const b64token = encryptedValue.replace(/-/g, "+").replace(/_/g, "/");
+    const token = Buffer.from(b64token + "=".repeat((4 - (b64token.length % 4)) % 4), "base64");
+    // Token layout: version(1) + timestamp(8) + iv(16) + ciphertext(N) + hmac(32)
+    if (token.length < 1 + 8 + 16 + 32) {
+        throw new Error("Invalid Fernet token: too short");
+    }
+    if (token[0] !== 0x80) {
+        throw new Error(`Invalid Fernet token version: ${token[0]}`);
+    }
+    const body = token.subarray(0, token.length - 32);
+    const tokenHmac = token.subarray(token.length - 32);
+    const iv = body.subarray(9, 25); // 1 + 8 = 9
+    const ciphertext = body.subarray(25);
+    // Verify HMAC-SHA256
+    const expectedHmac = createHmac("sha256", hmacKey).update(body).digest();
+    if (!timingSafeEqual(expectedHmac, tokenHmac)) {
+        throw new Error("Invalid Fernet token: HMAC mismatch");
+    }
+    // Decrypt AES-128-CBC and strip PKCS7 padding
+    const decipher = createDecipheriv("aes-128-cbc", aesKey, iv);
+    const decrypted = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final()
+    ]);
+    return decrypted.toString("utf-8");
+}
+/**
+ * Encrypt a value using Fernet (Python-compatible).
+ *
+ * Produces a token that Python's cryptography.Fernet can decrypt.
+ * Format: base64url(version(1) | timestamp(8) | iv(16) | ciphertext(N) | hmac(32))
+ *
+ * @param masterKey - The master key as a base64 or utf-8 string.
+ * @param userId - The user ID used as PBKDF2 salt.
+ * @param plaintext - The plaintext to encrypt.
+ */
+export function encryptFernet(masterKey, userId, plaintext) {
+    const masterKeyBytes = Buffer.from(masterKey, "utf-8");
+    const salt = Buffer.from(userId, "utf-8");
+    const derived = pbkdf2Sync(masterKeyBytes, salt, PBKDF2_ITERATIONS, 32, "sha256");
+    const hmacKey = derived.subarray(0, 16);
+    const aesKey = derived.subarray(16, 32);
+    const iv = randomBytes(16);
+    // Timestamp: seconds since epoch as big-endian uint64
+    const timestamp = BigInt(Math.floor(Date.now() / 1000));
+    const tsBuf = Buffer.alloc(8);
+    tsBuf.writeBigUInt64BE(timestamp);
+    // Pad plaintext to 16-byte boundary (PKCS7)
+    const plaintextBuf = Buffer.from(plaintext, "utf-8");
+    const padLen = 16 - (plaintextBuf.length % 16);
+    const padded = Buffer.concat([plaintextBuf, Buffer.alloc(padLen, padLen)]);
+    const cipher = createCipheriv("aes-128-cbc", aesKey, iv);
+    cipher.setAutoPadding(false);
+    const ciphertext = Buffer.concat([cipher.update(padded), cipher.final()]);
+    // Build body: version(1) + timestamp(8) + iv(16) + ciphertext
+    const body = Buffer.concat([
+        Buffer.from([FERNET_VERSION]),
+        tsBuf,
+        iv,
+        ciphertext
+    ]);
+    // HMAC-SHA256 over body
+    const hmac = createHmac("sha256", hmacKey).update(body).digest();
+    const token = Buffer.concat([body, hmac]);
+    // Encode as base64url (no padding)
+    return token
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=/g, "");
+}
+/**
+ * Check if a master key is valid by attempting to decrypt a test value.
+ *
+ * @param masterKey - The master key to validate.
+ * @param testEncryptedValue - An encrypted test value to decrypt.
+ * @param userId - The user ID used as salt for the test value.
+ * @returns True if the master key is valid, false otherwise.
+ */
+export function isValidMasterKey(masterKey, testEncryptedValue, userId) {
+    try {
+        decrypt(masterKey, userId, testEncryptedValue);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,WAAW,EACX,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,eAAe,EAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAErD,4BAA4B;AAC5B,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,uBAAuB;AAC9C,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,kBAAkB;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AAEvC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,uDAAuD;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAChC,SAAS,EACT,MAAM,CAAC,MAAM,GAAG,eAAe,CAChC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAC/D,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,mGAAmG;IACnG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CACxB,cAAc,EACd,IAAI,EACJ,iBAAiB,EACjB,EAAE,EACF,QAAQ,CACT,CAAC;IAEF,oFAAoF;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExC,qCAAqC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACtD,QAAQ,CACT,CAAC;IAEF,8EAA8E;IAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErC,qBAAqB;IACrB,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CACxB,cAAc,EACd,IAAI,EACJ,iBAAiB,EACjB,EAAE,EACF,QAAQ,CACT,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,sDAAsD;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAElC,4CAA4C;IAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE1E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7B,KAAK;QACL,EAAE;QACF,UAAU;KACX,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,mCAAmC;IACnC,OAAO,KAAK;SACT,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,kBAA0B,EAC1B,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { generateMasterKey, deriveKey, encrypt, decrypt, decryptFernet, encryptFernet, isValidMasterKey } from "./crypto.js";
+export { getMasterKey, initMasterKey, clearMasterKeyCache, setMasterKey, setMasterKeyPersistent, deleteMasterKey, isUsingEnvKey, isUsingAwsKey, setKeytarLoader, resetKeytarLoader, KeychainAccessError } from "./master-key.js";
+export { runStartupChecks, type StartupCheckResult } from "./startup-checks.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { generateMasterKey, deriveKey, encrypt, decrypt, decryptFernet, encryptFernet, isValidMasterKey } from "./crypto.js";
+export { getMasterKey, initMasterKey, clearMasterKeyCache, setMasterKey, setMasterKeyPersistent, deleteMasterKey, isUsingEnvKey, isUsingAwsKey, setKeytarLoader, resetKeytarLoader, KeychainAccessError } from "./master-key.js";
+export { runStartupChecks } from "./startup-checks.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAA2B,MAAM,qBAAqB,CAAC"}

package/dist/master-key.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Master key management with keychain and AWS Secrets Manager support.
+ *
+ * This module manages the master encryption key for secrets, storing it securely
+ * in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
+ * or AWS Secrets Manager.
+ *
+ * Key sources (in order of precedence):
+ * 1. SECRETS_MASTER_KEY environment variable
+ * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME env var set)
+ * 3. System keychain via keytar
+ * 4. Auto-generated key (persisted to keychain when available)
+ *
+ * NOTE on encryption compatibility: TS uses AES-256-GCM while Python uses Fernet.
+ * Secrets encrypted in one runtime cannot be decrypted in the other.
+ * New secrets must be created via the appropriate runtime's endpoints.
+ */
+/** Minimal keytar interface for the methods we use. */
+interface KeytarModule {
+    getPassword(service: string, account: string): Promise<string | null>;
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+}
+/**
+ * Thrown when the system keychain cannot be accessed. Callers can detect this
+ * specifically (vs other startup failures) to decide whether re-prompting the
+ * user for keychain access makes sense.
+ */
+export declare class KeychainAccessError extends Error {
+    constructor(message: string);
+}
+/**
+ * Replace the keytar implementation (for testing / dependency injection).
+ */
+export declare function setKeytarLoader(keytarImpl: KeytarModule): void;
+/**
+ * Restore the default keytar implementation (for testing).
+ */
+export declare function resetKeytarLoader(): void;
+/**
+ * Get the master encryption key (synchronous).
+ *
+ * Checks sources in order:
+ * 1. Cached key (if previously retrieved, e.g. via initMasterKey)
+ * 2. SECRETS_MASTER_KEY environment variable
+ * 3. Auto-generates a new key (will not persist unless initMasterKey was called)
+ *
+ * For full resolution including keychain and AWS, call initMasterKey() once at startup.
+ *
+ * @returns The master key as a base64-encoded string.
+ */
+export declare function getMasterKey(): string;
+/**
+ * Initialize the master key from all available sources (async).
+ *
+ * Should be called once at application startup to resolve the master key
+ * from keychain or AWS Secrets Manager. After this call, getMasterKey()
+ * will return the resolved key synchronously.
+ *
+ * Resolution order:
+ * 1. SECRETS_MASTER_KEY environment variable
+ * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME is set)
+ * 3. System keychain via keytar
+ * 4. Auto-generate and persist to keychain
+ *
+ * @returns The master key as a base64-encoded string.
+ */
+export declare function initMasterKey(): Promise<string>;
+/**
+ * Clear the cached master key.
+ *
+ * Forces the next call to getMasterKey() or initMasterKey() to
+ * re-read from environment, AWS, or keychain.
+ */
+export declare function clearMasterKeyCache(): void;
+/**
+ * Set a specific master key (useful for testing or migration).
+ *
+ * @param masterKey - The master key to use.
+ */
+export declare function setMasterKey(masterKey: string): void;
+/**
+ * Set the master key and persist it to the system keychain.
+ *
+ * @param masterKey - The master key to set (base64-encoded string).
+ * @throws {Error} If keychain write fails.
+ */
+export declare function setMasterKeyPersistent(masterKey: string): Promise<void>;
+/**
+ * Delete the master key from the system keychain.
+ *
+ * WARNING: This will make all encrypted secrets inaccessible!
+ *
+ * @returns True if the key was deleted, false otherwise.
+ * @throws {Error} If keychain deletion fails.
+ */
+export declare function deleteMasterKey(): Promise<boolean>;
+/**
+ * Check if the master key is being sourced from an environment variable.
+ *
+ * @returns True if SECRETS_MASTER_KEY environment variable is set.
+ */
+export declare function isUsingEnvKey(): boolean;
+/**
+ * Check if the master key should be sourced from AWS Secrets Manager.
+ *
+ * @returns True if AWS_SECRETS_MASTER_KEY_NAME environment variable is set.
+ */
+export declare function isUsingAwsKey(): boolean;
+export {};
+//# sourceMappingURL=master-key.d.ts.map

package/dist/master-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"master-key.d.ts","sourceRoot":"","sources":["../src/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,uDAAuD;AACvD,UAAU,YAAY;IACpB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAkCD;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,YAAY,GAAG,IAAI,CAG9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAkBrC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAuDrD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAQxD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}

package/dist/master-key.js

@@ -0,0 +1,255 @@
+/**
+ * Master key management with keychain and AWS Secrets Manager support.
+ *
+ * This module manages the master encryption key for secrets, storing it securely
+ * in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
+ * or AWS Secrets Manager.
+ *
+ * Key sources (in order of precedence):
+ * 1. SECRETS_MASTER_KEY environment variable
+ * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME env var set)
+ * 3. System keychain via keytar
+ * 4. Auto-generated key (persisted to keychain when available)
+ *
+ * NOTE on encryption compatibility: TS uses AES-256-GCM while Python uses Fernet.
+ * Secrets encrypted in one runtime cannot be decrypted in the other.
+ * New secrets must be created via the appropriate runtime's endpoints.
+ */
+import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { generateMasterKey } from "./crypto.js";
+import { createLogger } from "@nodetool-ai/config";
+const log = createLogger("nodetool.security.master-key");
+const KEYRING_SERVICE = "nodetool";
+const KEYRING_ACCOUNT = "secrets_master_key";
+let cachedMasterKey = null;
+/**
+ * Thrown when the system keychain cannot be accessed. Callers can detect this
+ * specifically (vs other startup failures) to decide whether re-prompting the
+ * user for keychain access makes sense.
+ */
+export class KeychainAccessError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "KeychainAccessError";
+    }
+}
+function keychainAccessError(message) {
+    return new KeychainAccessError(`${message}. Allow NodeTool access to the system keychain when prompted.`);
+}
+/** Lazy-load keytar. Keychain failures are fatal: no generated fallback key. */
+let _keytarResolved = null;
+async function loadKeytar() {
+    if (_keytarResolved) {
+        return _keytarResolved;
+    }
+    try {
+        const mod = await import("keytar");
+        _keytarResolved = mod.default ?? mod;
+        return _keytarResolved;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log.error("keytar native module failed to load. For headless deployments " +
+            "(Docker, CI, Linux servers without libsecret) set the SECRETS_MASTER_KEY " +
+            "environment variable to a base64-encoded 32-byte key, or set " +
+            "AWS_SECRETS_MASTER_KEY_NAME to source the key from AWS Secrets Manager.", { error: message });
+        throw keychainAccessError(`Unable to load system keychain backend: ${message}`);
+    }
+}
+/** Active keytar implementation (can be overridden in tests). */
+let _keytar = null;
+/**
+ * Replace the keytar implementation (for testing / dependency injection).
+ */
+export function setKeytarLoader(keytarImpl) {
+    _keytar = keytarImpl;
+    _keytarResolved = keytarImpl;
+}
+/**
+ * Restore the default keytar implementation (for testing).
+ */
+export function resetKeytarLoader() {
+    _keytar = null;
+    _keytarResolved = null;
+}
+/**
+ * Retrieve master key from AWS Secrets Manager.
+ *
+ * Only attempted if AWS_SECRETS_MASTER_KEY_NAME environment variable is set.
+ */
+async function getFromAwsSecrets(secretName) {
+    try {
+        const region = process.env["AWS_REGION"] ?? "us-east-1";
+        const client = new SecretsManagerClient({ region });
+        const response = await client.send(new GetSecretValueCommand({ SecretId: secretName }));
+        if (response.SecretString) {
+            return response.SecretString;
+        }
+        if (response.SecretBinary) {
+            return Buffer.from(response.SecretBinary).toString("utf-8");
+        }
+        return null;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log.warn("Master key source failed, trying next", {
+            source: "aws",
+            error: message
+        });
+        return null;
+    }
+}
+/**
+ * Get the master encryption key (synchronous).
+ *
+ * Checks sources in order:
+ * 1. Cached key (if previously retrieved, e.g. via initMasterKey)
+ * 2. SECRETS_MASTER_KEY environment variable
+ * 3. Auto-generates a new key (will not persist unless initMasterKey was called)
+ *
+ * For full resolution including keychain and AWS, call initMasterKey() once at startup.
+ *
+ * @returns The master key as a base64-encoded string.
+ */
+export function getMasterKey() {
+    if (cachedMasterKey !== null) {
+        return cachedMasterKey;
+    }
+    // 1. Check environment variable
+    const envKey = process.env["SECRETS_MASTER_KEY"];
+    if (envKey) {
+        log.debug("Master key source", { source: "env" });
+        cachedMasterKey = envKey;
+        return envKey;
+    }
+    // 2. Auto-generate (not persisted without initMasterKey)
+    log.debug("Master key source", { source: "generated" });
+    const newKey = generateMasterKey();
+    cachedMasterKey = newKey;
+    return newKey;
+}
+/**
+ * Initialize the master key from all available sources (async).
+ *
+ * Should be called once at application startup to resolve the master key
+ * from keychain or AWS Secrets Manager. After this call, getMasterKey()
+ * will return the resolved key synchronously.
+ *
+ * Resolution order:
+ * 1. SECRETS_MASTER_KEY environment variable
+ * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME is set)
+ * 3. System keychain via keytar
+ * 4. Auto-generate and persist to keychain
+ *
+ * @returns The master key as a base64-encoded string.
+ */
+export async function initMasterKey() {
+    // Return cached key if available
+    if (cachedMasterKey !== null) {
+        return cachedMasterKey;
+    }
+    // 1. Check environment variable
+    const envKey = process.env["SECRETS_MASTER_KEY"];
+    if (envKey) {
+        log.debug("Master key source", { source: "env" });
+        cachedMasterKey = envKey;
+        return envKey;
+    }
+    // 2. Check AWS Secrets Manager if configured
+    const awsSecretName = process.env["AWS_SECRETS_MASTER_KEY_NAME"];
+    if (awsSecretName) {
+        const awsKey = await getFromAwsSecrets(awsSecretName);
+        if (awsKey) {
+            log.debug("Master key source", { source: "aws" });
+            cachedMasterKey = awsKey;
+            return awsKey;
+        }
+    }
+    // 3. Try system keychain via keytar
+    const keytar = _keytar ?? await loadKeytar();
+    try {
+        const storedKey = await keytar.getPassword(KEYRING_SERVICE, KEYRING_ACCOUNT);
+        if (storedKey) {
+            log.debug("Master key source", { source: "keychain" });
+            cachedMasterKey = storedKey;
+            return storedKey;
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw keychainAccessError(`Unable to read master key from system keychain: ${message}`);
+    }
+    // 4. Auto-generate and persist to keychain. Persisting is mandatory; using
+    // an unpersisted generated key would make encrypted secrets unrecoverable on
+    // the next launch.
+    const newKey = generateMasterKey();
+    try {
+        await keytar.setPassword(KEYRING_SERVICE, KEYRING_ACCOUNT, newKey);
+        log.info("Master key generated and stored");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw keychainAccessError(`Unable to store master key in system keychain: ${message}`);
+    }
+    cachedMasterKey = newKey;
+    return newKey;
+}
+/**
+ * Clear the cached master key.
+ *
+ * Forces the next call to getMasterKey() or initMasterKey() to
+ * re-read from environment, AWS, or keychain.
+ */
+export function clearMasterKeyCache() {
+    cachedMasterKey = null;
+}
+/**
+ * Set a specific master key (useful for testing or migration).
+ *
+ * @param masterKey - The master key to use.
+ */
+export function setMasterKey(masterKey) {
+    cachedMasterKey = masterKey;
+}
+/**
+ * Set the master key and persist it to the system keychain.
+ *
+ * @param masterKey - The master key to set (base64-encoded string).
+ * @throws {Error} If keychain write fails.
+ */
+export async function setMasterKeyPersistent(masterKey) {
+    const keytar = _keytar ?? await loadKeytar();
+    await keytar.setPassword(KEYRING_SERVICE, KEYRING_ACCOUNT, masterKey);
+    cachedMasterKey = masterKey;
+}
+/**
+ * Delete the master key from the system keychain.
+ *
+ * WARNING: This will make all encrypted secrets inaccessible!
+ *
+ * @returns True if the key was deleted, false otherwise.
+ * @throws {Error} If keychain deletion fails.
+ */
+export async function deleteMasterKey() {
+    const keytar = _keytar ?? await loadKeytar();
+    const deleted = await keytar.deletePassword(KEYRING_SERVICE, KEYRING_ACCOUNT);
+    cachedMasterKey = null;
+    return deleted;
+}
+/**
+ * Check if the master key is being sourced from an environment variable.
+ *
+ * @returns True if SECRETS_MASTER_KEY environment variable is set.
+ */
+export function isUsingEnvKey() {
+    return process.env["SECRETS_MASTER_KEY"] !== undefined;
+}
+/**
+ * Check if the master key should be sourced from AWS Secrets Manager.
+ *
+ * @returns True if AWS_SECRETS_MASTER_KEY_NAME environment variable is set.
+ */
+export function isUsingAwsKey() {
+    return process.env["AWS_SECRETS_MASTER_KEY_NAME"] !== undefined;
+}
+//# sourceMappingURL=master-key.js.map

package/dist/master-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"master-key.js","sourceRoot":"","sources":["../src/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,IAAI,eAAe,GAAkB,IAAI,CAAC;AAa1C;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,IAAI,mBAAmB,CAC5B,GAAG,OAAO,+DAA+D,CAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,IAAI,eAAe,GAAwB,IAAI,CAAC;AAChD,KAAK,UAAU,UAAU;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,eAAe,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACrC,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,KAAK,CACP,gEAAgE;YAC9D,2EAA2E;YAC3E,+DAA+D;YAC/D,yEAAyE,EAC3E,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACF,MAAM,mBAAmB,CAAC,2CAA2C,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAwB;IACtD,OAAO,GAAG,UAAU,CAAC;IACrB,eAAe,GAAG,UAAU,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,IAAI,CAAC;IACf,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CACpD,CAAC;QAEF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,YAAY,CAAC;QAC/B,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE;YAChD,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yDAAyD;IACzD,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,eAAe,GAAG,MAAM,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,iCAAiC;IACjC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACjE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,eAAe,GAAG,MAAM,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CACxC,eAAe,EACf,eAAe,CAChB,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACvD,eAAe,GAAG,SAAS,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,kDAAkD,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,eAAe,GAAG,MAAM,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IACtE,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,eAAe,EACf,eAAe,CAChB,CAAC;IACF,eAAe,GAAG,IAAI,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC"}

package/dist/startup-checks.d.ts

@@ -0,0 +1,12 @@
+export interface StartupCheckResult {
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Run startup health checks.
+ *
+ * - Checks that the master encryption key is loadable.
+ * - Warns about missing optional API keys.
+ */
+export declare function runStartupChecks(): Promise<StartupCheckResult>;
+//# sourceMappingURL=startup-checks.d.ts.map

package/dist/startup-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-checks.d.ts","sourceRoot":"","sources":["../src/startup-checks.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAaD;;;;;GAKG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAyBpE"}

package/dist/startup-checks.js

@@ -0,0 +1,45 @@
+/**
+ * Startup checks — T-SEC-8.
+ *
+ * Validates that the system is properly configured before accepting requests.
+ */
+import { getMasterKey } from "./master-key.js";
+/** Well-known optional API keys that should be configured for full functionality. */
+const OPTIONAL_API_KEYS = [
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "GEMINI_API_KEY",
+    "REPLICATE_API_TOKEN",
+    "HF_TOKEN",
+    "ELEVENLABS_API_KEY",
+    "FAL_API_KEY"
+];
+/**
+ * Run startup health checks.
+ *
+ * - Checks that the master encryption key is loadable.
+ * - Warns about missing optional API keys.
+ */
+export async function runStartupChecks() {
+    const errors = [];
+    const warnings = [];
+    // Check master key
+    try {
+        const key = getMasterKey();
+        if (!key) {
+            errors.push("Master encryption key could not be loaded");
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        errors.push(`Master key initialization failed: ${msg}`);
+    }
+    // Check optional API keys
+    for (const envVar of OPTIONAL_API_KEYS) {
+        if (!process.env[envVar]) {
+            warnings.push(`${envVar} is not set — related features will be unavailable`);
+        }
+    }
+    return { errors, warnings };
+}
+//# sourceMappingURL=startup-checks.js.map

package/dist/startup-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-checks.js","sourceRoot":"","sources":["../src/startup-checks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C,qFAAqF;AACrF,MAAM,iBAAiB,GAAG;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,oDAAoD,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@nodetool-ai/security",
+  "version": "0.7.0-rc.11",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "node ../../scripts/build-typescript-workspace.mjs",
+    "test": "vitest run",
+    "lint": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@nodetool-ai/config": "^0.7.0-rc.11",
+    "@aws-sdk/client-secrets-manager": "^3.1029.0",
+    "keytar": "^7.9.0"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.2",
+    "typescript": "^5.7.2"
+  },
+  "exports": {
+    ".": {
+      "nodetool-dev": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nodetool-ai/nodetool.git",
+    "directory": "packages/security"
+  },
+  "homepage": "https://nodetool.ai",
+  "bugs": {
+    "url": "https://github.com/nodetool-ai/nodetool/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
+}