@noy-db/at-azure-keyvault 0.2.0-pre.9 → 0.3.0-pre.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/at-azure-keyvault",
-  "version": "0.2.0-pre.9",
+  "version": "0.3.0-pre.2",
   "description": "Azure Key Vault sealing key provider for noy-db managed-passphrase mode.",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -17,17 +17,10 @@
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "require": {
-        "types": "./dist/index.d.cts",
-        "default": "./dist/index.cjs"
-      }
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
-  "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -36,20 +29,20 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "peerDependencies": {
     "@azure/keyvault-keys": "^4.0.0",
     "@azure/identity": "^4.0.0",
-    "@noy-db/hub": "0.2.0-pre.9"
+    "@noy-db/hub": "0.3.0-pre.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@azure/keyvault-keys": "^4.0.0",
     "@azure/identity": "^4.0.0",
-    "@noy-db/on-shamir": "0.2.0-pre.9",
-    "@noy-db/to-memory": "0.2.0-pre.9",
-    "@noy-db/hub": "0.2.0-pre.9"
+    "@noy-db/hub": "0.3.0-pre.2",
+    "@noy-db/to-memory": "0.3.0-pre.2",
+    "@noy-db/on-shamir": "0.3.0-pre.2"
   },
   "keywords": [
     "noy-db",

package/dist/index.cjs

@@ -1,51 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  azureKeyVaultSealingProvider: () => azureKeyVaultSealingProvider
-});
-module.exports = __toCommonJS(index_exports);
-var import_keyvault_keys = require("@azure/keyvault-keys");
-var import_identity = require("@azure/identity");
-function azureKeyVaultSealingProvider(opts) {
-  const algorithm = opts.algorithm ?? "RSA-OAEP-256";
-  const client = opts.cryptographyClient ?? new import_keyvault_keys.CryptographyClient(opts.keyId, new import_identity.DefaultAzureCredential());
-  return {
-    id: `azure-kv:${opts.keyId}`,
-    async seal(passphrase) {
-      const res = await client.encrypt({ algorithm, plaintext: passphrase });
-      const c = res?.result;
-      if (!c) throw new Error("@noy-db/at-azure-keyvault: Key Vault encrypt returned no result");
-      return c instanceof Uint8Array ? c : new Uint8Array(c);
-    },
-    async unseal(sealed) {
-      const res = await client.decrypt({ algorithm, ciphertext: sealed });
-      const p = res?.result;
-      if (!p) throw new Error("@noy-db/at-azure-keyvault: Key Vault decrypt returned no result");
-      return p instanceof Uint8Array ? p : new Uint8Array(p);
-    }
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  azureKeyVaultSealingProvider
-});
-//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db\n * managed-passphrase mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is\n * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault\n * audit-log-backed access record of every time a user's vault is opened —\n * no additional instrumentation required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on Azure where a Key Vault RSA key costs less\n *   than engineering an equivalent audit trail.\n * - Any case where you need an auditable, Azure-native key custody record\n *   for every vault open.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a Key Vault and an RSA key (one-time):\n * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus\n * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048\n * # Note the full key identifier URL from the output (id field).\n *\n * # 2. Grant the host's managed identity or service principal the\n * #    encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:\n * az keyvault set-policy --name my-noydb-vault \\\n *   --object-id <MANAGED_IDENTITY_OBJECT_ID> \\\n *   --key-permissions encrypt decrypt\n * # Credentials are resolved automatically via DefaultAzureCredential:\n * # managed identity attached to the Azure host, AZURE_CLIENT_ID /\n * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for\n * # local dev.\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: azureKeyVaultSealingProvider({\n *     keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',\n *   }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider } from '@noy-db/hub'\nimport {\n  CryptographyClient,\n  type EncryptResult,\n  type DecryptResult,\n  type RsaEncryptParameters,\n  type RsaDecryptParameters,\n} from '@azure/keyvault-keys'\nimport { DefaultAzureCredential } from '@azure/identity'\n\n/** Minimal client surface required by {@link azureKeyVaultSealingProvider}. */\ninterface CryptoLike {\n  encrypt(params: RsaEncryptParameters): Promise<EncryptResult>\n  decrypt(params: RsaDecryptParameters): Promise<DecryptResult>\n}\n\n/** Options for {@link azureKeyVaultSealingProvider}. */\nexport interface AzureKeyVaultSealingProviderOptions {\n  /**\n   * Full **versioned** key identifier URL, e.g.\n   * `https://<vault>.vault.azure.net/keys/<name>/<version>`.\n   *\n   * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the\n   * key version at construction time and every decrypt call is pinned to it.\n   * A versionless URL (`.../keys/<name>`) resolves to \"latest\" — if the key\n   * auto-rotates, all passphrases sealed under the previous version become\n   * **permanently undecryptable**. Always pin to an explicit version.\n   */\n  readonly keyId: string\n  /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */\n  readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP'\n  /**\n   * Optional pre-built CryptographyClient (DI for tests).\n   * Default: builds one with `DefaultAzureCredential`.\n   * Never pass raw Azure credentials in these options.\n   */\n  readonly cryptographyClient?: CryptoLike\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by Azure Key Vault Encrypt / Decrypt.\n *\n * Credentials are resolved via `DefaultAzureCredential` — managed identities\n * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`\n * env vars, or `az login` for local dev. Never pass raw credentials in the\n * options; inject a pre-configured `CryptographyClient` for non-default auth\n * instead.\n *\n * @throws Error when Key Vault returns no result (guards against unexpected\n * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)\n * propagates as-is.\n */\nexport function azureKeyVaultSealingProvider(opts: AzureKeyVaultSealingProviderOptions): SealingKeyProvider {\n  const algorithm = opts.algorithm ?? 'RSA-OAEP-256'\n  const client: CryptoLike = opts.cryptographyClient\n    ?? new CryptographyClient(opts.keyId, new DefaultAzureCredential())\n\n  return {\n    id: `azure-kv:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const res = await client.encrypt({ algorithm, plaintext: passphrase })\n      const c = res?.result\n      if (!c) throw new Error('@noy-db/at-azure-keyvault: Key Vault encrypt returned no result')\n      return c instanceof Uint8Array ? c : new Uint8Array(c)\n    },\n\n    async unseal(sealed) {\n      const res = await client.decrypt({ algorithm, ciphertext: sealed })\n      const p = res?.result\n      if (!p) throw new Error('@noy-db/at-azure-keyvault: Key Vault decrypt returned no result')\n      return p instanceof Uint8Array ? p : new Uint8Array(p)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2DA,2BAMO;AACP,sBAAuC;AA4ChC,SAAS,6BAA6B,MAA+D;AAC1G,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,SAAqB,KAAK,sBAC3B,IAAI,wCAAmB,KAAK,OAAO,IAAI,uCAAuB,CAAC;AAEpE,SAAO;AAAA,IACL,IAAI,YAAY,KAAK,KAAK;AAAA,IAE1B,MAAM,KAAK,YAAY;AACrB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,WAAW,WAAW,CAAC;AACrE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,YAAY,OAAO,CAAC;AAClE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,104 +0,0 @@
-import { SealingKeyProvider } from '@noy-db/hub';
-import { RsaEncryptParameters, EncryptResult, RsaDecryptParameters, DecryptResult } from '@azure/keyvault-keys';
-
-/**
- * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db
- * managed-passphrase mode.
- *
- * An `at-*` provider that seals and unseals the hub-generated random
- * passphrase via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is
- * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault
- * audit-log-backed access record of every time a user's vault is opened —
- * no additional instrumentation required.
- *
- * ## When to use
- *
- * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA
- *   with managed-encryption requirements, SOC 2 Type II).
- * - Workloads already running on Azure where a Key Vault RSA key costs less
- *   than engineering an equivalent audit trail.
- * - Any case where you need an auditable, Azure-native key custody record
- *   for every vault open.
- *
- * ## Setup
- *
- * ```bash
- * # 1. Create a Key Vault and an RSA key (one-time):
- * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus
- * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048
- * # Note the full key identifier URL from the output (id field).
- *
- * # 2. Grant the host's managed identity or service principal the
- * #    encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:
- * az keyvault set-policy --name my-noydb-vault \
- *   --object-id <MANAGED_IDENTITY_OBJECT_ID> \
- *   --key-permissions encrypt decrypt
- * # Credentials are resolved automatically via DefaultAzureCredential:
- * # managed identity attached to the Azure host, AZURE_CLIENT_ID /
- * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for
- * # local dev.
- * ```
- *
- * ```ts
- * // 3. In your app:
- * import { createNoydb } from '@noy-db/hub'
- * import { azureKeyVaultSealingProvider } from '@noy-db/at-azure-keyvault'
- * import { shamirRecoveryProvider } from '@noy-db/on-shamir'
- *
- * const db = await createNoydb({
- *   store,
- *   user: 'alice',
- *   passphraseMode: 'managed',
- *   sealingKey: azureKeyVaultSealingProvider({
- *     keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',
- *   }),
- *   shamirRecovery: shamirRecoveryProvider(),
- * })
- * ```
- *
- * @packageDocumentation
- */
-
-/** Minimal client surface required by {@link azureKeyVaultSealingProvider}. */
-interface CryptoLike {
-    encrypt(params: RsaEncryptParameters): Promise<EncryptResult>;
-    decrypt(params: RsaDecryptParameters): Promise<DecryptResult>;
-}
-/** Options for {@link azureKeyVaultSealingProvider}. */
-interface AzureKeyVaultSealingProviderOptions {
-    /**
-     * Full **versioned** key identifier URL, e.g.
-     * `https://<vault>.vault.azure.net/keys/<name>/<version>`.
-     *
-     * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the
-     * key version at construction time and every decrypt call is pinned to it.
-     * A versionless URL (`.../keys/<name>`) resolves to "latest" — if the key
-     * auto-rotates, all passphrases sealed under the previous version become
-     * **permanently undecryptable**. Always pin to an explicit version.
-     */
-    readonly keyId: string;
-    /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */
-    readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP';
-    /**
-     * Optional pre-built CryptographyClient (DI for tests).
-     * Default: builds one with `DefaultAzureCredential`.
-     * Never pass raw Azure credentials in these options.
-     */
-    readonly cryptographyClient?: CryptoLike;
-}
-/**
- * Build a {@link SealingKeyProvider} backed by Azure Key Vault Encrypt / Decrypt.
- *
- * Credentials are resolved via `DefaultAzureCredential` — managed identities
- * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`
- * env vars, or `az login` for local dev. Never pass raw credentials in the
- * options; inject a pre-configured `CryptographyClient` for non-default auth
- * instead.
- *
- * @throws Error when Key Vault returns no result (guards against unexpected
- * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)
- * propagates as-is.
- */
-declare function azureKeyVaultSealingProvider(opts: AzureKeyVaultSealingProviderOptions): SealingKeyProvider;
-
-export { type AzureKeyVaultSealingProviderOptions, azureKeyVaultSealingProvider };