@noy-db/at-azure-keyvault 0.2.0-pre.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vLannaAi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,102 @@
+# @noy-db/at-azure-keyvault
+
+**Azure Key Vault sealing key provider for noy-db [managed-passphrase mode](https://github.com/vLannaAi/noy-db/issues/14).**
+
+An `at-*` provider that seals and unseals the hub-generated random passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is an authenticated Key Vault API call — giving you an Azure Monitor / Key Vault audit-log-backed access record of every time a user's vault is opened, with no additional instrumentation required.
+
+Like all `at-*` providers, this is a *trusted host* provider: the host you deploy it on CAN decrypt what it unseals. The security boundary is your Azure RBAC / Key Vault access policy — access is controlled by which managed identities or service principals hold the `encrypt` + `decrypt` key permissions on the Key Vault key, not by a secret the host keeps in memory.
+
+## Install
+
+```bash
+pnpm add @noy-db/hub @noy-db/at-azure-keyvault @noy-db/on-shamir
+# or: npm install @noy-db/hub @noy-db/at-azure-keyvault @noy-db/on-shamir
+```
+
+## Setup
+
+```bash
+# 1. Create a Key Vault and an RSA key (one-time):
+az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus
+az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048
+# Note the full key identifier URL from the output (the "id" field).
+
+# 2. Grant the host's managed identity or service principal encrypt + decrypt
+#    key permissions on the vault:
+az keyvault set-policy --name my-noydb-vault \
+  --object-id <MANAGED_IDENTITY_OBJECT_ID> \
+  --key-permissions encrypt decrypt
+# Credentials are resolved automatically via DefaultAzureCredential:
+# managed identity attached to the Azure host, AZURE_CLIENT_ID /
+# AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for
+# local dev.
+```
+
+```ts
+// 3. In your app:
+import { createNoydb } from '@noy-db/hub'
+import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'
+import { shamirRecoveryProvider } from '@noy-db/on-shamir'
+
+const db = await createNoydb({
+  store,
+  user: 'alice',
+  passphraseMode: 'managed',
+  sealingKey: azureKeyVaultSealingProvider({
+    keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',
+  }),
+  shamirRecovery: shamirRecoveryProvider(),
+})
+
+const vault = await db.openVault('acme')
+// Hub generated a 256-bit random on first open, sealed it via Key Vault Encrypt,
+// and persisted to _meta/sealed-passphrase. The user never sees a passphrase.
+// On reopen, at-azure-keyvault calls Key Vault Decrypt transparently.
+// Azure Key Vault audit logs record every Encrypt/Decrypt call with caller
+// identity + key identifier.
+```
+
+## When to use this provider
+
+- Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA with managed-encryption requirements, SOC 2 Type II).
+- Workloads already running on Azure where a Key Vault RSA key costs less than engineering an equivalent audit trail.
+- Any case where you need an auditable, Azure-native key custody record for every vault open.
+
+## When NOT to use this provider
+
+- Non-Azure or multi-cloud deployments where adding an Azure dependency is undesirable. Use [`@noy-db/at-env`](../at-env) for a zero-extra-dependency option.
+- Local dev / CI where you don't want real Key Vault calls or Azure credentials in CI. Use [`@noy-db/at-env`](../at-env) or `MemorySealingKeyProvider` from `@noy-db/hub` instead.
+
+## Key rotation
+
+**Azure RSA decrypt is version-bound.** Unlike AWS/GCP symmetric KMS — where the key version travels inside the ciphertext blob — Azure's `CryptographyClient` resolves the key version at construction time and every decrypt call is pinned to that version. This has a critical consequence:
+
+- **Always use a versioned `keyId`** (`https://<vault>.vault.azure.net/keys/<name>/<version>`). The version in the URL is your guarantee that every sealed passphrase can be decrypted by the exact key material used to encrypt it.
+- **Do NOT enable Key Vault auto-rotation on a versionless `keyId`.** If the key rotates while you are using a versionless URL, the `CryptographyClient` will resolve to the new version, and every passphrase sealed under the previous version becomes **permanently undecryptable** — every managed-mode vault is locked out with no recovery path.
+
+**To rotate your sealing key** (e.g. for scheduled cryptographic hygiene):
+
+1. Create a new key version (or a new key) in Key Vault.
+2. For each vault, call `unseal` with the old versioned `keyId` to recover the plaintext passphrase.
+3. Call `seal` with a provider configured for the **new** versioned `keyId` to produce a new ciphertext.
+4. Persist the new sealed blob and update your app configuration to the new versioned `keyId`.
+
+This is a deliberate migration step — not transparent rotation. Treat it the same way you would a secret rotation in any other system.
+
+## API
+
+```ts
+function azureKeyVaultSealingProvider(opts: {
+  keyId: string                           // Full key identifier URL
+  algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP'  // default: 'RSA-OAEP-256'
+  cryptographyClient?: CryptoLike         // optional pre-built client (useful for tests)
+}): SealingKeyProvider
+```
+
+Never pass raw Azure credentials in the options — inject a pre-configured `CryptographyClient` for non-default auth. The default builds a `CryptographyClient` with `DefaultAzureCredential`.
+
+Returns a [`SealingKeyProvider`](../hub/src/team/managed-passphrase.ts) — the contract `@noy-db/hub`'s managed-passphrase mode consumes.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,51 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  azureKeyVaultSealingProvider: () => azureKeyVaultSealingProvider
+});
+module.exports = __toCommonJS(index_exports);
+var import_keyvault_keys = require("@azure/keyvault-keys");
+var import_identity = require("@azure/identity");
+function azureKeyVaultSealingProvider(opts) {
+  const algorithm = opts.algorithm ?? "RSA-OAEP-256";
+  const client = opts.cryptographyClient ?? new import_keyvault_keys.CryptographyClient(opts.keyId, new import_identity.DefaultAzureCredential());
+  return {
+    id: `azure-kv:${opts.keyId}`,
+    async seal(passphrase) {
+      const res = await client.encrypt({ algorithm, plaintext: passphrase });
+      const c = res?.result;
+      if (!c) throw new Error("@noy-db/at-azure-keyvault: Key Vault encrypt returned no result");
+      return c instanceof Uint8Array ? c : new Uint8Array(c);
+    },
+    async unseal(sealed) {
+      const res = await client.decrypt({ algorithm, ciphertext: sealed });
+      const p = res?.result;
+      if (!p) throw new Error("@noy-db/at-azure-keyvault: Key Vault decrypt returned no result");
+      return p instanceof Uint8Array ? p : new Uint8Array(p);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  azureKeyVaultSealingProvider
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db\n * managed-passphrase mode (#190).\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is\n * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault\n * audit-log-backed access record of every time a user's vault is opened —\n * no additional instrumentation required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on Azure where a Key Vault RSA key costs less\n *   than engineering an equivalent audit trail.\n * - Any case where you need an auditable, Azure-native key custody record\n *   for every vault open.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a Key Vault and an RSA key (one-time):\n * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus\n * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048\n * # Note the full key identifier URL from the output (id field).\n *\n * # 2. Grant the host's managed identity or service principal the\n * #    encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:\n * az keyvault set-policy --name my-noydb-vault \\\n *   --object-id <MANAGED_IDENTITY_OBJECT_ID> \\\n *   --key-permissions encrypt decrypt\n * # Credentials are resolved automatically via DefaultAzureCredential:\n * # managed identity attached to the Azure host, AZURE_CLIENT_ID /\n * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for\n * # local dev.\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: azureKeyVaultSealingProvider({\n *     keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',\n *   }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider } from '@noy-db/hub'\nimport {\n  CryptographyClient,\n  type EncryptResult,\n  type DecryptResult,\n  type RsaEncryptParameters,\n  type RsaDecryptParameters,\n} from '@azure/keyvault-keys'\nimport { DefaultAzureCredential } from '@azure/identity'\n\n/** Minimal client surface required by {@link azureKeyVaultSealingProvider}. */\ninterface CryptoLike {\n  encrypt(params: RsaEncryptParameters): Promise<EncryptResult>\n  decrypt(params: RsaDecryptParameters): Promise<DecryptResult>\n}\n\n/** Options for {@link azureKeyVaultSealingProvider}. */\nexport interface AzureKeyVaultSealingProviderOptions {\n  /**\n   * Full **versioned** key identifier URL, e.g.\n   * `https://<vault>.vault.azure.net/keys/<name>/<version>`.\n   *\n   * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the\n   * key version at construction time and every decrypt call is pinned to it.\n   * A versionless URL (`.../keys/<name>`) resolves to \"latest\" — if the key\n   * auto-rotates, all passphrases sealed under the previous version become\n   * **permanently undecryptable**. Always pin to an explicit version.\n   */\n  readonly keyId: string\n  /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */\n  readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP'\n  /**\n   * Optional pre-built CryptographyClient (DI for tests).\n   * Default: builds one with `DefaultAzureCredential`.\n   * Never pass raw Azure credentials in these options.\n   */\n  readonly cryptographyClient?: CryptoLike\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by Azure Key Vault Encrypt / Decrypt.\n *\n * Credentials are resolved via `DefaultAzureCredential` — managed identities\n * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`\n * env vars, or `az login` for local dev. Never pass raw credentials in the\n * options; inject a pre-configured `CryptographyClient` for non-default auth\n * instead.\n *\n * @throws Error when Key Vault returns no result (guards against unexpected\n * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)\n * propagates as-is.\n */\nexport function azureKeyVaultSealingProvider(opts: AzureKeyVaultSealingProviderOptions): SealingKeyProvider {\n  const algorithm = opts.algorithm ?? 'RSA-OAEP-256'\n  const client: CryptoLike = opts.cryptographyClient\n    ?? new CryptographyClient(opts.keyId, new DefaultAzureCredential())\n\n  return {\n    id: `azure-kv:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const res = await client.encrypt({ algorithm, plaintext: passphrase })\n      const c = res?.result\n      if (!c) throw new Error('@noy-db/at-azure-keyvault: Key Vault encrypt returned no result')\n      return c instanceof Uint8Array ? c : new Uint8Array(c)\n    },\n\n    async unseal(sealed) {\n      const res = await client.decrypt({ algorithm, ciphertext: sealed })\n      const p = res?.result\n      if (!p) throw new Error('@noy-db/at-azure-keyvault: Key Vault decrypt returned no result')\n      return p instanceof Uint8Array ? p : new Uint8Array(p)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2DA,2BAMO;AACP,sBAAuC;AA4ChC,SAAS,6BAA6B,MAA+D;AAC1G,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,SAAqB,KAAK,sBAC3B,IAAI,wCAAmB,KAAK,OAAO,IAAI,uCAAuB,CAAC;AAEpE,SAAO;AAAA,IACL,IAAI,YAAY,KAAK,KAAK;AAAA,IAE1B,MAAM,KAAK,YAAY;AACrB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,WAAW,WAAW,CAAC;AACrE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,YAAY,OAAO,CAAC;AAClE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,104 @@
+import { SealingKeyProvider } from '@noy-db/hub';
+import { RsaEncryptParameters, EncryptResult, RsaDecryptParameters, DecryptResult } from '@azure/keyvault-keys';
+
+/**
+ * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db
+ * managed-passphrase mode (#190).
+ *
+ * An `at-*` provider that seals and unseals the hub-generated random
+ * passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is
+ * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault
+ * audit-log-backed access record of every time a user's vault is opened —
+ * no additional instrumentation required.
+ *
+ * ## When to use
+ *
+ * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA
+ *   with managed-encryption requirements, SOC 2 Type II).
+ * - Workloads already running on Azure where a Key Vault RSA key costs less
+ *   than engineering an equivalent audit trail.
+ * - Any case where you need an auditable, Azure-native key custody record
+ *   for every vault open.
+ *
+ * ## Setup
+ *
+ * ```bash
+ * # 1. Create a Key Vault and an RSA key (one-time):
+ * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus
+ * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048
+ * # Note the full key identifier URL from the output (id field).
+ *
+ * # 2. Grant the host's managed identity or service principal the
+ * #    encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:
+ * az keyvault set-policy --name my-noydb-vault \
+ *   --object-id <MANAGED_IDENTITY_OBJECT_ID> \
+ *   --key-permissions encrypt decrypt
+ * # Credentials are resolved automatically via DefaultAzureCredential:
+ * # managed identity attached to the Azure host, AZURE_CLIENT_ID /
+ * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for
+ * # local dev.
+ * ```
+ *
+ * ```ts
+ * // 3. In your app:
+ * import { createNoydb } from '@noy-db/hub'
+ * import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'
+ * import { shamirRecoveryProvider } from '@noy-db/on-shamir'
+ *
+ * const db = await createNoydb({
+ *   store,
+ *   user: 'alice',
+ *   passphraseMode: 'managed',
+ *   sealingKey: azureKeyVaultSealingProvider({
+ *     keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',
+ *   }),
+ *   shamirRecovery: shamirRecoveryProvider(),
+ * })
+ * ```
+ *
+ * @packageDocumentation
+ */
+
+/** Minimal client surface required by {@link azureKeyVaultSealingProvider}. */
+interface CryptoLike {
+    encrypt(params: RsaEncryptParameters): Promise<EncryptResult>;
+    decrypt(params: RsaDecryptParameters): Promise<DecryptResult>;
+}
+/** Options for {@link azureKeyVaultSealingProvider}. */
+interface AzureKeyVaultSealingProviderOptions {
+    /**
+     * Full **versioned** key identifier URL, e.g.
+     * `https://<vault>.vault.azure.net/keys/<name>/<version>`.
+     *
+     * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the
+     * key version at construction time and every decrypt call is pinned to it.
+     * A versionless URL (`.../keys/<name>`) resolves to "latest" — if the key
+     * auto-rotates, all passphrases sealed under the previous version become
+     * **permanently undecryptable**. Always pin to an explicit version.
+     */
+    readonly keyId: string;
+    /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */
+    readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP';
+    /**
+     * Optional pre-built CryptographyClient (DI for tests).
+     * Default: builds one with `DefaultAzureCredential`.
+     * Never pass raw Azure credentials in these options.
+     */
+    readonly cryptographyClient?: CryptoLike;
+}
+/**
+ * Build a {@link SealingKeyProvider} backed by Azure Key Vault Encrypt / Decrypt.
+ *
+ * Credentials are resolved via `DefaultAzureCredential` — managed identities
+ * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`
+ * env vars, or `az login` for local dev. Never pass raw credentials in the
+ * options; inject a pre-configured `CryptographyClient` for non-default auth
+ * instead.
+ *
+ * @throws Error when Key Vault returns no result (guards against unexpected
+ * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)
+ * propagates as-is.
+ */
+declare function azureKeyVaultSealingProvider(opts: AzureKeyVaultSealingProviderOptions): SealingKeyProvider;
+
+export { type AzureKeyVaultSealingProviderOptions, azureKeyVaultSealingProvider };

package/dist/index.d.ts

@@ -0,0 +1,104 @@
+import { SealingKeyProvider } from '@noy-db/hub';
+import { RsaEncryptParameters, EncryptResult, RsaDecryptParameters, DecryptResult } from '@azure/keyvault-keys';
+
+/**
+ * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db
+ * managed-passphrase mode (#190).
+ *
+ * An `at-*` provider that seals and unseals the hub-generated random
+ * passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is
+ * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault
+ * audit-log-backed access record of every time a user's vault is opened —
+ * no additional instrumentation required.
+ *
+ * ## When to use
+ *
+ * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA
+ *   with managed-encryption requirements, SOC 2 Type II).
+ * - Workloads already running on Azure where a Key Vault RSA key costs less
+ *   than engineering an equivalent audit trail.
+ * - Any case where you need an auditable, Azure-native key custody record
+ *   for every vault open.
+ *
+ * ## Setup
+ *
+ * ```bash
+ * # 1. Create a Key Vault and an RSA key (one-time):
+ * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus
+ * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048
+ * # Note the full key identifier URL from the output (id field).
+ *
+ * # 2. Grant the host's managed identity or service principal the
+ * #    encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:
+ * az keyvault set-policy --name my-noydb-vault \
+ *   --object-id <MANAGED_IDENTITY_OBJECT_ID> \
+ *   --key-permissions encrypt decrypt
+ * # Credentials are resolved automatically via DefaultAzureCredential:
+ * # managed identity attached to the Azure host, AZURE_CLIENT_ID /
+ * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for
+ * # local dev.
+ * ```
+ *
+ * ```ts
+ * // 3. In your app:
+ * import { createNoydb } from '@noy-db/hub'
+ * import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'
+ * import { shamirRecoveryProvider } from '@noy-db/on-shamir'
+ *
+ * const db = await createNoydb({
+ *   store,
+ *   user: 'alice',
+ *   passphraseMode: 'managed',
+ *   sealingKey: azureKeyVaultSealingProvider({
+ *     keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',
+ *   }),
+ *   shamirRecovery: shamirRecoveryProvider(),
+ * })
+ * ```
+ *
+ * @packageDocumentation
+ */
+
+/** Minimal client surface required by {@link azureKeyVaultSealingProvider}. */
+interface CryptoLike {
+    encrypt(params: RsaEncryptParameters): Promise<EncryptResult>;
+    decrypt(params: RsaDecryptParameters): Promise<DecryptResult>;
+}
+/** Options for {@link azureKeyVaultSealingProvider}. */
+interface AzureKeyVaultSealingProviderOptions {
+    /**
+     * Full **versioned** key identifier URL, e.g.
+     * `https://<vault>.vault.azure.net/keys/<name>/<version>`.
+     *
+     * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the
+     * key version at construction time and every decrypt call is pinned to it.
+     * A versionless URL (`.../keys/<name>`) resolves to "latest" — if the key
+     * auto-rotates, all passphrases sealed under the previous version become
+     * **permanently undecryptable**. Always pin to an explicit version.
+     */
+    readonly keyId: string;
+    /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */
+    readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP';
+    /**
+     * Optional pre-built CryptographyClient (DI for tests).
+     * Default: builds one with `DefaultAzureCredential`.
+     * Never pass raw Azure credentials in these options.
+     */
+    readonly cryptographyClient?: CryptoLike;
+}
+/**
+ * Build a {@link SealingKeyProvider} backed by Azure Key Vault Encrypt / Decrypt.
+ *
+ * Credentials are resolved via `DefaultAzureCredential` — managed identities
+ * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`
+ * env vars, or `az login` for local dev. Never pass raw credentials in the
+ * options; inject a pre-configured `CryptographyClient` for non-default auth
+ * instead.
+ *
+ * @throws Error when Key Vault returns no result (guards against unexpected
+ * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)
+ * propagates as-is.
+ */
+declare function azureKeyVaultSealingProvider(opts: AzureKeyVaultSealingProviderOptions): SealingKeyProvider;
+
+export { type AzureKeyVaultSealingProviderOptions, azureKeyVaultSealingProvider };

package/dist/index.js

@@ -0,0 +1,28 @@
+// src/index.ts
+import {
+  CryptographyClient
+} from "@azure/keyvault-keys";
+import { DefaultAzureCredential } from "@azure/identity";
+function azureKeyVaultSealingProvider(opts) {
+  const algorithm = opts.algorithm ?? "RSA-OAEP-256";
+  const client = opts.cryptographyClient ?? new CryptographyClient(opts.keyId, new DefaultAzureCredential());
+  return {
+    id: `azure-kv:${opts.keyId}`,
+    async seal(passphrase) {
+      const res = await client.encrypt({ algorithm, plaintext: passphrase });
+      const c = res?.result;
+      if (!c) throw new Error("@noy-db/at-azure-keyvault: Key Vault encrypt returned no result");
+      return c instanceof Uint8Array ? c : new Uint8Array(c);
+    },
+    async unseal(sealed) {
+      const res = await client.decrypt({ algorithm, ciphertext: sealed });
+      const p = res?.result;
+      if (!p) throw new Error("@noy-db/at-azure-keyvault: Key Vault decrypt returned no result");
+      return p instanceof Uint8Array ? p : new Uint8Array(p);
+    }
+  };
+}
+export {
+  azureKeyVaultSealingProvider
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db\n * managed-passphrase mode (#190).\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is\n * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault\n * audit-log-backed access record of every time a user's vault is opened —\n * no additional instrumentation required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on Azure where a Key Vault RSA key costs less\n *   than engineering an equivalent audit trail.\n * - Any case where you need an auditable, Azure-native key custody record\n *   for every vault open.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a Key Vault and an RSA key (one-time):\n * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus\n * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048\n * # Note the full key identifier URL from the output (id field).\n *\n * # 2. Grant the host's managed identity or service principal the\n * #    encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:\n * az keyvault set-policy --name my-noydb-vault \\\n *   --object-id <MANAGED_IDENTITY_OBJECT_ID> \\\n *   --key-permissions encrypt decrypt\n * # Credentials are resolved automatically via DefaultAzureCredential:\n * # managed identity attached to the Azure host, AZURE_CLIENT_ID /\n * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for\n * # local dev.\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: azureKeyVaultSealingProvider({\n *     keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',\n *   }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider } from '@noy-db/hub'\nimport {\n  CryptographyClient,\n  type EncryptResult,\n  type DecryptResult,\n  type RsaEncryptParameters,\n  type RsaDecryptParameters,\n} from '@azure/keyvault-keys'\nimport { DefaultAzureCredential } from '@azure/identity'\n\n/** Minimal client surface required by {@link azureKeyVaultSealingProvider}. */\ninterface CryptoLike {\n  encrypt(params: RsaEncryptParameters): Promise<EncryptResult>\n  decrypt(params: RsaDecryptParameters): Promise<DecryptResult>\n}\n\n/** Options for {@link azureKeyVaultSealingProvider}. */\nexport interface AzureKeyVaultSealingProviderOptions {\n  /**\n   * Full **versioned** key identifier URL, e.g.\n   * `https://<vault>.vault.azure.net/keys/<name>/<version>`.\n   *\n   * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the\n   * key version at construction time and every decrypt call is pinned to it.\n   * A versionless URL (`.../keys/<name>`) resolves to \"latest\" — if the key\n   * auto-rotates, all passphrases sealed under the previous version become\n   * **permanently undecryptable**. Always pin to an explicit version.\n   */\n  readonly keyId: string\n  /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */\n  readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP'\n  /**\n   * Optional pre-built CryptographyClient (DI for tests).\n   * Default: builds one with `DefaultAzureCredential`.\n   * Never pass raw Azure credentials in these options.\n   */\n  readonly cryptographyClient?: CryptoLike\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by Azure Key Vault Encrypt / Decrypt.\n *\n * Credentials are resolved via `DefaultAzureCredential` — managed identities\n * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`\n * env vars, or `az login` for local dev. Never pass raw credentials in the\n * options; inject a pre-configured `CryptographyClient` for non-default auth\n * instead.\n *\n * @throws Error when Key Vault returns no result (guards against unexpected\n * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)\n * propagates as-is.\n */\nexport function azureKeyVaultSealingProvider(opts: AzureKeyVaultSealingProviderOptions): SealingKeyProvider {\n  const algorithm = opts.algorithm ?? 'RSA-OAEP-256'\n  const client: CryptoLike = opts.cryptographyClient\n    ?? new CryptographyClient(opts.keyId, new DefaultAzureCredential())\n\n  return {\n    id: `azure-kv:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const res = await client.encrypt({ algorithm, plaintext: passphrase })\n      const c = res?.result\n      if (!c) throw new Error('@noy-db/at-azure-keyvault: Key Vault encrypt returned no result')\n      return c instanceof Uint8Array ? c : new Uint8Array(c)\n    },\n\n    async unseal(sealed) {\n      const res = await client.decrypt({ algorithm, ciphertext: sealed })\n      const p = res?.result\n      if (!p) throw new Error('@noy-db/at-azure-keyvault: Key Vault decrypt returned no result')\n      return p instanceof Uint8Array ? p : new Uint8Array(p)\n    },\n  }\n}\n"],"mappings":";AA2DA;AAAA,EACE;AAAA,OAKK;AACP,SAAS,8BAA8B;AA4ChC,SAAS,6BAA6B,MAA+D;AAC1G,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,SAAqB,KAAK,sBAC3B,IAAI,mBAAmB,KAAK,OAAO,IAAI,uBAAuB,CAAC;AAEpE,SAAO;AAAA,IACL,IAAI,YAAY,KAAK,KAAK;AAAA,IAE1B,MAAM,KAAK,YAAY;AACrB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,WAAW,WAAW,CAAC;AACrE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,YAAY,OAAO,CAAC;AAClE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@noy-db/at-azure-keyvault",
+  "version": "0.2.0-pre.1",
+  "description": "Azure Key Vault sealing key provider for noy-db managed-passphrase mode.",
+  "license": "MIT",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/at-azure-keyvault#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "directory": "packages/at-azure-keyvault"
+  },
+  "bugs": {
+    "url": "https://github.com/vLannaAi/noy-db/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "peerDependencies": {
+    "@azure/keyvault-keys": "^4.0.0",
+    "@azure/identity": "^4.0.0",
+    "@noy-db/hub": "0.2.0-pre.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@azure/keyvault-keys": "^4.0.0",
+    "@azure/identity": "^4.0.0",
+    "@noy-db/hub": "0.2.0-pre.1",
+    "@noy-db/on-shamir": "0.2.0-pre.1",
+    "@noy-db/to-memory": "0.2.0-pre.1"
+  },
+  "keywords": [
+    "noy-db",
+    "at-azure-keyvault",
+    "azure-keyvault",
+    "kms",
+    "sealing-key-provider",
+    "managed-passphrase",
+    "encryption",
+    "zero-knowledge"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}