@objectstack/service-settings 10.2.0 → 10.3.0

package/dist/index.cjs

@@ -916,6 +916,7 @@ var import_node_path = require("path");
 var SECRET_KEY_ENV = "OS_SECRET_KEY";
 var DEV_KEY_ENV = "OS_DEV_CRYPTO_KEY";
 var DEV_KEY_LEGACY_ENV = "OBJECTSTACK_DEV_CRYPTO_KEY";
+var AUTOKEY_ENV = "OS_CRYPTO_AUTOKEY";
 var processEnv = () => globalThis.process?.env ?? {};
 var detectMode = (env) => {
   if (env.VITEST || env.NODE_ENV === "test") return "test";
@@ -939,6 +940,10 @@ var parseKey = (raw) => {
   }
   return void 0;
 };
+var parseBool = (raw) => {
+  const v = raw?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+};
 var loadExistingKey = (path) => {
   try {
     if (!(0, import_node_fs.existsSync)(path)) return void 0;
@@ -1012,6 +1017,17 @@ function resolveDataKey(opts) {
       );
       return { key: existing, source: "file" };
     }
+    if (parseBool(env[AUTOKEY_ENV])) {
+      const persisted2 = loadOrCreateKey(path);
+      if (persisted2) {
+        if (persisted2.generated) {
+          warn(
+            `[LocalCryptoProvider] No ${SECRET_KEY_ENV} set \u2014 minted a new AES-256-GCM key and persisted it to ${path} (mode 0600). Restarts on this host reuse it automatically. For containers, CI, or multi-node, set ${SECRET_KEY_ENV} so every node shares one key.`
+          );
+        }
+        return { key: persisted2.key, source: persisted2.generated ? "generated-file" : "file" };
+      }
+    }
     throw new Error(MISSING_PROD_KEY_MSG(path));
   }
   const persisted = loadOrCreateKey(path);