@oronts/vendure-data-hub-plugin 0.1.0

package/dist/src/utils/code-security.utils.js

@@ -0,0 +1,504 @@
+"use strict";
+/**
+ * Code Security Utilities
+ *
+ * Security validation for user-provided code expressions.
+ * Uses defense-in-depth approach with multiple layers of protection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTOTYPE_POLLUTION_PATTERNS = exports.DISALLOWED_KEYWORDS = exports.DANGEROUS_PATTERNS = exports.DEFAULT_CODE_SECURITY_CONFIG = void 0;
+exports.validateUserCode = validateUserCode;
+exports.validateConditionExpression = validateConditionExpression;
+exports.createCodeSandbox = createCodeSandbox;
+// Import directly from defaults to avoid circular dependency with constants/index.ts
+// which imports ../operators -> script.operators.ts -> this file
+const defaults_1 = require("../constants/defaults");
+/**
+ * Default security configuration
+ */
+exports.DEFAULT_CODE_SECURITY_CONFIG = {
+    maxCodeLength: defaults_1.CODE_SECURITY.MAX_CODE_LENGTH,
+    maxConditionLength: defaults_1.CODE_SECURITY.MAX_CONDITION_LENGTH,
+    maxExpressionComplexity: defaults_1.CODE_SECURITY.MAX_EXPRESSION_COMPLEXITY,
+    maxPropertyAccessDepth: defaults_1.CODE_SECURITY.MAX_PROPERTY_ACCESS_DEPTH,
+    allowArrayMethods: true,
+    allowStringMethods: true,
+};
+/**
+ * Dangerous patterns that indicate potential code injection
+ * Uses multiple regex patterns for defense in depth
+ */
+exports.DANGEROUS_PATTERNS = {
+    /** Statement terminators and code blocks */
+    STATEMENT_PATTERNS: /[;{}]|`|\$\{/,
+    /** Comment patterns that could hide malicious code */
+    COMMENT_PATTERNS: /\/\/|\/\*|\*\//,
+    /** Escape sequences that could bypass validation */
+    ESCAPE_SEQUENCES: /\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|\\u\{[0-9a-fA-F]+\}/,
+    /** Unicode escape sequences in various forms (control characters, line/paragraph separators) */
+    // Using character codes to avoid ESLint no-control-regex false positive
+    UNICODE_ESCAPES: new RegExp('[' + String.fromCharCode(0) + '-' + String.fromCharCode(31) + String.fromCharCode(127) + '-' + String.fromCharCode(159) + String.fromCharCode(8232) + String.fromCharCode(8233) + ']'),
+    /** Octal escape sequences */
+    OCTAL_ESCAPES: /\\[0-7]{1,3}/,
+    /** HTML/XML entities that could be used for obfuscation */
+    HTML_ENTITIES: /&#x?[0-9a-fA-F]+;?/i,
+    /** Base64 encoded content patterns */
+    BASE64_PATTERNS: /atob\s*\(|btoa\s*\(/i,
+    /** String concatenation tricks */
+    STRING_CONCAT_TRICKS: /\[\s*['"][^'"]*['"]\s*\]\s*\(/,
+    /** Bracket notation property access with computed values */
+    COMPUTED_PROPERTY_ACCESS: /\[\s*(?:['"`][^'"`]*['"`]\s*\+|\+\s*['"`])/,
+};
+/**
+ * Keywords that should never appear in user code
+ * Block list to prevent sandbox escape
+ */
+exports.DISALLOWED_KEYWORDS = [
+    // Function/code execution
+    'eval',
+    'Function',
+    'AsyncFunction',
+    'GeneratorFunction',
+    'AsyncGeneratorFunction',
+    // Module system
+    'require',
+    'import',
+    'export',
+    'module',
+    'exports',
+    // Object creation and classes
+    'class',
+    'new',
+    'extends',
+    // Context access
+    'this',
+    'self',
+    'globalThis',
+    // Browser globals
+    'window',
+    'document',
+    'navigator',
+    'location',
+    'history',
+    'localStorage',
+    'sessionStorage',
+    'indexedDB',
+    'fetch',
+    'XMLHttpRequest',
+    'WebSocket',
+    // Node.js globals
+    'global',
+    'process',
+    'Buffer',
+    '__dirname',
+    '__filename',
+    // Prototype chain manipulation
+    'constructor',
+    'prototype',
+    '__proto__',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+    'getPrototypeOf',
+    'setPrototypeOf',
+    'defineProperty',
+    'defineProperties',
+    'getOwnPropertyDescriptor',
+    'getOwnPropertyDescriptors',
+    'getOwnPropertyNames',
+    'getOwnPropertySymbols',
+    // Reflection
+    'Reflect',
+    'Proxy',
+    // Special objects
+    'arguments',
+    'caller',
+    'callee',
+    // Async patterns
+    'yield',
+    'async',
+    'await',
+    'Promise',
+    // Code generation
+    'with',
+    'debugger',
+    // Dangerous built-ins
+    'setTimeout',
+    'setInterval',
+    'setImmediate',
+    'clearTimeout',
+    'clearInterval',
+    'clearImmediate',
+    'queueMicrotask',
+    // Symbol access
+    'Symbol',
+    // WeakRef for potential memory attacks
+    'WeakRef',
+    'FinalizationRegistry',
+];
+/**
+ * Pattern to match disallowed keywords as whole words
+ * Uses word boundaries to avoid false positives
+ */
+const DISALLOWED_KEYWORDS_PATTERN = new RegExp(`\\b(${exports.DISALLOWED_KEYWORDS.join('|')})\\b`, 'i');
+/**
+ * Prototype pollution attack patterns
+ */
+exports.PROTOTYPE_POLLUTION_PATTERNS = [
+    // Direct prototype access
+    /__proto__/,
+    /prototype\s*\[/,
+    /\[\s*['"]prototype['"]\s*\]/,
+    /\[\s*['"]__proto__['"]\s*\]/,
+    // Constructor access
+    /constructor\s*\[/,
+    /\[\s*['"]constructor['"]\s*\]/,
+    /\.constructor\s*\./,
+    // Object.prototype manipulation
+    /Object\s*\.\s*prototype/,
+    /Array\s*\.\s*prototype/,
+    /String\s*\.\s*prototype/,
+    /Number\s*\.\s*prototype/,
+    /Function\s*\.\s*prototype/,
+];
+/**
+ * Allowed safe characters pattern for simple expressions
+ */
+const SAFE_EXPRESSION_PATTERN = /^[a-zA-Z0-9_$.\s+\-*/%&|!?:=<>()[\],'"]*$/;
+/**
+ * Validates user code for security issues
+ * Throws an error if any security concern is detected
+ */
+function validateUserCode(code, config = {}) {
+    const mergedConfig = { ...exports.DEFAULT_CODE_SECURITY_CONFIG, ...config };
+    // Basic validation
+    if (!code || typeof code !== 'string') {
+        throw new Error('Code must be a non-empty string');
+    }
+    // Length check
+    if (code.length > mergedConfig.maxCodeLength) {
+        throw new Error(`Code exceeds maximum length of ${mergedConfig.maxCodeLength} characters`);
+    }
+    // Normalize code for analysis (handle various whitespace)
+    const normalizedCode = code.replace(/\s+/g, ' ').trim();
+    // Check dangerous patterns
+    checkDangerousPatterns(normalizedCode);
+    // Check disallowed keywords
+    checkDisallowedKeywords(normalizedCode);
+    // Check prototype pollution
+    checkPrototypePollution(normalizedCode);
+    // Check expression complexity
+    checkExpressionComplexity(normalizedCode, mergedConfig);
+}
+/**
+ * Validates condition expressions (more restrictive than general code)
+ */
+function validateConditionExpression(condition, config = {}) {
+    const mergedConfig = { ...exports.DEFAULT_CODE_SECURITY_CONFIG, ...config };
+    if (!condition || typeof condition !== 'string') {
+        throw new Error('Condition must be a non-empty string');
+    }
+    if (condition.length > mergedConfig.maxConditionLength) {
+        throw new Error(`Condition exceeds maximum length of ${mergedConfig.maxConditionLength} characters`);
+    }
+    // All the same checks as user code
+    validateUserCode(condition, {
+        ...config,
+        maxCodeLength: mergedConfig.maxConditionLength,
+    });
+    // Additional check: conditions should only contain safe characters
+    if (!SAFE_EXPRESSION_PATTERN.test(condition)) {
+        throw new Error('Condition contains invalid characters');
+    }
+}
+/**
+ * Checks for dangerous code patterns
+ */
+function checkDangerousPatterns(code) {
+    const patterns = exports.DANGEROUS_PATTERNS;
+    if (patterns.STATEMENT_PATTERNS.test(code)) {
+        throw new Error('Code contains disallowed patterns (semicolons, braces, backticks, or template literals)');
+    }
+    if (patterns.COMMENT_PATTERNS.test(code)) {
+        throw new Error('Code contains disallowed comment syntax');
+    }
+    if (patterns.ESCAPE_SEQUENCES.test(code)) {
+        throw new Error('Code contains disallowed escape sequences');
+    }
+    if (patterns.UNICODE_ESCAPES.test(code)) {
+        throw new Error('Code contains disallowed unicode characters');
+    }
+    if (patterns.OCTAL_ESCAPES.test(code)) {
+        throw new Error('Code contains disallowed octal escape sequences');
+    }
+    if (patterns.HTML_ENTITIES.test(code)) {
+        throw new Error('Code contains disallowed HTML entities');
+    }
+    if (patterns.BASE64_PATTERNS.test(code)) {
+        throw new Error('Code contains disallowed base64 functions');
+    }
+    if (patterns.STRING_CONCAT_TRICKS.test(code)) {
+        throw new Error('Code contains disallowed string concatenation patterns');
+    }
+    if (patterns.COMPUTED_PROPERTY_ACCESS.test(code)) {
+        throw new Error('Code contains disallowed computed property access');
+    }
+}
+/**
+ * Checks for disallowed keywords
+ */
+function checkDisallowedKeywords(code) {
+    if (DISALLOWED_KEYWORDS_PATTERN.test(code)) {
+        const match = code.match(DISALLOWED_KEYWORDS_PATTERN);
+        throw new Error(`Code contains disallowed keyword: ${match?.[1] ?? 'unknown'}`);
+    }
+}
+/**
+ * Checks for prototype pollution attack patterns
+ */
+function checkPrototypePollution(code) {
+    for (const pattern of exports.PROTOTYPE_POLLUTION_PATTERNS) {
+        if (pattern.test(code)) {
+            throw new Error('Code contains potential prototype pollution pattern');
+        }
+    }
+}
+/**
+ * Checks expression complexity to prevent resource exhaustion
+ */
+function checkExpressionComplexity(code, config) {
+    // Count nesting depth
+    let maxDepth = 0;
+    let currentDepth = 0;
+    for (const char of code) {
+        if (char === '(' || char === '[') {
+            currentDepth++;
+            maxDepth = Math.max(maxDepth, currentDepth);
+        }
+        else if (char === ')' || char === ']') {
+            currentDepth--;
+        }
+    }
+    // Count operators
+    const operatorMatches = code.match(/[+\-*/%&|!?:<>=]/g);
+    const operatorCount = operatorMatches?.length ?? 0;
+    // Calculate complexity score
+    const complexityScore = maxDepth * 2 + operatorCount;
+    if (complexityScore > config.maxExpressionComplexity) {
+        throw new Error(`Expression complexity (${complexityScore}) exceeds maximum allowed (${config.maxExpressionComplexity})`);
+    }
+    // Check property access depth
+    const propertyAccessMatches = code.match(/\./g);
+    const propertyAccessCount = propertyAccessMatches?.length ?? 0;
+    if (propertyAccessCount > config.maxPropertyAccessDepth) {
+        throw new Error(`Property access depth (${propertyAccessCount}) exceeds maximum allowed (${config.maxPropertyAccessDepth})`);
+    }
+}
+/**
+ * Creates a frozen sandbox environment with safe globals
+ * All objects are deeply frozen to prevent modification
+ */
+function createCodeSandbox(additionalGlobals = {}) {
+    // Create safe wrapper for Array that prevents prototype access
+    const SafeArray = {
+        isArray: Array.isArray.bind(Array),
+        from: (arr) => {
+            if (!Array.isArray(arr) && typeof arr !== 'string') {
+                throw new Error('Array.from only accepts arrays or strings');
+            }
+            return Array.from(arr);
+        },
+        of: (...items) => Array.of(...items),
+    };
+    // Create safe wrapper for Object that prevents dangerous operations
+    const SafeObject = {
+        keys: (obj) => {
+            if (obj === null || typeof obj !== 'object') {
+                throw new Error('Object.keys requires an object');
+            }
+            return Object.keys(obj);
+        },
+        values: (obj) => {
+            if (obj === null || typeof obj !== 'object') {
+                throw new Error('Object.values requires an object');
+            }
+            return Object.values(obj);
+        },
+        entries: (obj) => {
+            if (obj === null || typeof obj !== 'object') {
+                throw new Error('Object.entries requires an object');
+            }
+            return Object.entries(obj);
+        },
+        assign: (target, ...sources) => {
+            if (target === null || typeof target !== 'object') {
+                throw new Error('Object.assign requires an object target');
+            }
+            return Object.assign({}, target, ...sources);
+        },
+        freeze: (obj) => Object.freeze(obj),
+        isFrozen: (obj) => Object.isFrozen(obj),
+        hasOwn: (obj, key) => {
+            if (typeof key !== 'string') {
+                throw new Error('Property key must be a string');
+            }
+            // Prevent prototype pollution via hasOwn
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                return false;
+            }
+            return Object.prototype.hasOwnProperty.call(obj, key);
+        },
+    };
+    // Create safe Math wrapper
+    const SafeMath = {
+        abs: Math.abs,
+        ceil: Math.ceil,
+        floor: Math.floor,
+        round: Math.round,
+        max: Math.max,
+        min: Math.min,
+        pow: Math.pow,
+        sqrt: Math.sqrt,
+        random: Math.random,
+        sign: Math.sign,
+        trunc: Math.trunc,
+        PI: Math.PI,
+        E: Math.E,
+    };
+    // Create safe JSON wrapper
+    const SafeJSON = {
+        parse: (text) => {
+            if (typeof text !== 'string') {
+                throw new Error('JSON.parse requires a string');
+            }
+            const parsed = JSON.parse(text);
+            // Prevent prototype pollution in parsed objects
+            return sanitizeJsonObject(parsed);
+        },
+        stringify: (value) => JSON.stringify(value),
+    };
+    // Create safe Date functions (no constructor, just utilities)
+    const SafeDate = {
+        now: Date.now,
+        parse: Date.parse,
+        UTC: Date.UTC,
+    };
+    const sandbox = {
+        // Safe wrappers
+        Array: SafeArray,
+        Object: SafeObject,
+        Math: SafeMath,
+        JSON: SafeJSON,
+        Date: SafeDate,
+        // Primitive constructors (safe for type coercion)
+        String: (val) => String(val),
+        Number: (val) => Number(val),
+        Boolean: (val) => Boolean(val),
+        // Safe global functions
+        isArray: Array.isArray,
+        keys: SafeObject.keys,
+        values: SafeObject.values,
+        entries: SafeObject.entries,
+        isNaN: Number.isNaN,
+        isFinite: Number.isFinite,
+        parseFloat,
+        parseInt,
+        // URI functions (safe)
+        encodeURI,
+        decodeURI,
+        encodeURIComponent,
+        decodeURIComponent,
+        // Constants
+        undefined,
+        NaN,
+        Infinity,
+        // Type checking helpers
+        typeof: (val) => typeof val,
+        isNull: (val) => val === null,
+        isUndefined: (val) => val === undefined,
+        isString: (val) => typeof val === 'string',
+        isNumber: (val) => typeof val === 'number',
+        isBoolean: (val) => typeof val === 'boolean',
+        isObject: (val) => val !== null && typeof val === 'object',
+        // Add user-provided globals (validated)
+        ...sanitizeAdditionalGlobals(additionalGlobals),
+    };
+    // Deep freeze the sandbox to prevent modifications
+    return deepFreeze(sandbox);
+}
+/**
+ * Sanitizes JSON objects to prevent prototype pollution
+ */
+function sanitizeJsonObject(obj) {
+    if (obj === null || typeof obj !== 'object') {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(sanitizeJsonObject);
+    }
+    const sanitized = Object.create(null);
+    for (const [key, value] of Object.entries(obj)) {
+        // Skip dangerous keys
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            continue;
+        }
+        sanitized[key] = sanitizeJsonObject(value);
+    }
+    return sanitized;
+}
+/**
+ * Sanitizes additional globals to prevent injection
+ */
+function sanitizeAdditionalGlobals(globals) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(globals)) {
+        // Skip dangerous keys
+        if (exports.DISALLOWED_KEYWORDS.includes(key)) {
+            continue;
+        }
+        // Skip if key looks like prototype pollution
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            continue;
+        }
+        // Don't allow functions that could be exploited
+        if (typeof value === 'function') {
+            // Wrap functions to prevent access to their properties
+            sanitized[key] = createSafeFunction(value);
+        }
+        else if (value !== null && typeof value === 'object') {
+            sanitized[key] = sanitizeJsonObject(value);
+        }
+        else {
+            sanitized[key] = value;
+        }
+    }
+    return sanitized;
+}
+/**
+ * Creates a safe wrapper around a function
+ */
+function createSafeFunction(fn) {
+    const wrapper = (...args) => fn(...args);
+    // Remove access to function properties
+    Object.defineProperty(wrapper, 'constructor', {
+        value: undefined,
+        writable: false,
+        configurable: false,
+    });
+    return wrapper;
+}
+/**
+ * Deep freezes an object and all nested objects
+ */
+function deepFreeze(obj) {
+    Object.freeze(obj);
+    for (const key of Object.keys(obj)) {
+        const value = obj[key];
+        if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+            deepFreeze(value);
+        }
+    }
+    return obj;
+}
+//# sourceMappingURL=code-security.utils.js.map

package/dist/src/utils/code-security.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-security.utils.js","sourceRoot":"","sources":["../../../src/utils/code-security.utils.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAqNH,4CAgCC;AAKD,kEA0BC;AAuHD,8CA6IC;AAthBD,qFAAqF;AACrF,iEAAiE;AACjE,oDAAsD;AAoBtD;;GAEG;AACU,QAAA,4BAA4B,GAAuB;IAC5D,aAAa,EAAE,wBAAa,CAAC,eAAe;IAC5C,kBAAkB,EAAE,wBAAa,CAAC,oBAAoB;IACtD,uBAAuB,EAAE,wBAAa,CAAC,yBAAyB;IAChE,sBAAsB,EAAE,wBAAa,CAAC,yBAAyB;IAC/D,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;CAC3B,CAAC;AAEF;;;GAGG;AACU,QAAA,kBAAkB,GAAG;IAC9B,4CAA4C;IAC5C,kBAAkB,EAAE,cAAc;IAElC,sDAAsD;IACtD,gBAAgB,EAAE,gBAAgB;IAElC,oDAAoD;IACpD,gBAAgB,EAAE,yDAAyD;IAE3E,gGAAgG;IAChG,wEAAwE;IACxE,eAAe,EAAE,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IAEnN,6BAA6B;IAC7B,aAAa,EAAE,cAAc;IAE7B,2DAA2D;IAC3D,aAAa,EAAE,qBAAqB;IAEpC,sCAAsC;IACtC,eAAe,EAAE,sBAAsB;IAEvC,kCAAkC;IAClC,oBAAoB,EAAE,+BAA+B;IAErD,4DAA4D;IAC5D,wBAAwB,EAAE,4CAA4C;CAChE,CAAC;AAEX;;;GAGG;AACU,QAAA,mBAAmB,GAAG;IAC/B,0BAA0B;IAC1B,MAAM;IACN,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,wBAAwB;IAExB,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IAET,8BAA8B;IAC9B,OAAO;IACP,KAAK;IACL,SAAS;IAET,iBAAiB;IACjB,MAAM;IACN,MAAM;IACN,YAAY;IAEZ,kBAAkB;IAClB,QAAQ;IACR,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,WAAW;IAEX,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,WAAW;IACX,YAAY;IAEZ,+BAA+B;IAC/B,aAAa;IACb,WAAW;IACX,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,0BAA0B;IAC1B,2BAA2B;IAC3B,qBAAqB;IACrB,uBAAuB;IAEvB,aAAa;IACb,SAAS;IACT,OAAO;IAEP,kBAAkB;IAClB,WAAW;IACX,QAAQ;IACR,QAAQ;IAER,iBAAiB;IACjB,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IAET,kBAAkB;IAClB,MAAM;IACN,UAAU;IAEV,sBAAsB;IACtB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAEhB,gBAAgB;IAChB,QAAQ;IAER,uCAAuC;IACvC,SAAS;IACT,sBAAsB;CAChB,CAAC;AAEX;;;GAGG;AACH,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAC1C,OAAO,2BAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAC1C,GAAG,CACN,CAAC;AAEF;;GAEG;AACU,QAAA,4BAA4B,GAAG;IACxC,0BAA0B;IAC1B,WAAW;IACX,gBAAgB;IAChB,6BAA6B;IAC7B,6BAA6B;IAE7B,qBAAqB;IACrB,kBAAkB;IAClB,+BAA+B;IAC/B,oBAAoB;IAEpB,gCAAgC;IAChC,yBAAyB;IACzB,wBAAwB;IACxB,yBAAyB;IACzB,yBAAyB;IACzB,2BAA2B;CACrB,CAAC;AAEX;;GAEG;AACH,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AAE5E;;;GAGG;AACH,SAAgB,gBAAgB,CAC5B,IAAY,EACZ,SAAsC,EAAE;IAExC,MAAM,YAAY,GAAG,EAAE,GAAG,oCAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEpE,mBAAmB;IACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,CAAC;IAED,eAAe;IACf,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACX,kCAAkC,YAAY,CAAC,aAAa,aAAa,CAC5E,CAAC;IACN,CAAC;IAED,0DAA0D;IAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAExD,2BAA2B;IAC3B,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAEvC,4BAA4B;IAC5B,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAExC,4BAA4B;IAC5B,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAExC,8BAA8B;IAC9B,yBAAyB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CACvC,SAAiB,EACjB,SAAsC,EAAE;IAExC,MAAM,YAAY,GAAG,EAAE,GAAG,oCAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEpE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACX,uCAAuC,YAAY,CAAC,kBAAkB,aAAa,CACtF,CAAC;IACN,CAAC;IAED,mCAAmC;IACnC,gBAAgB,CAAC,SAAS,EAAE;QACxB,GAAG,MAAM;QACT,aAAa,EAAE,YAAY,CAAC,kBAAkB;KACjD,CAAC,CAAC;IAEH,mEAAmE;IACnE,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,0BAAkB,CAAC;IAEpC,IAAI,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACX,yFAAyF,CAC5F,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,IAAY;IACzC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACX,qCAAqC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CACjE,CAAC;IACN,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,IAAY;IACzC,KAAK,MAAM,OAAO,IAAI,oCAA4B,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,qDAAqD,CACxD,CAAC;QACN,CAAC;IACL,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAC9B,IAAY,EACZ,MAA0B;IAE1B,sBAAsB;IACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,YAAY,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,YAAY,EAAE,CAAC;QACnB,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC;IAEnD,6BAA6B;IAC7B,MAAM,eAAe,GAAG,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC;IAErD,IAAI,eAAe,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACX,0BAA0B,eAAe,8BAA8B,MAAM,CAAC,uBAAuB,GAAG,CAC3G,CAAC;IACN,CAAC;IAED,8BAA8B;IAC9B,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC;IAE/D,IAAI,mBAAmB,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACX,0BAA0B,mBAAmB,8BAA8B,MAAM,CAAC,sBAAsB,GAAG,CAC9G,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC7B,oBAA6C,EAAE;IAE/C,+DAA+D;IAC/D,MAAM,SAAS,GAAG;QACd,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,EAAE,CAAC,GAAY,EAAE,EAAE;YACnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAwB,CAAC,CAAC;QAChD,CAAC;QACD,EAAE,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;KAClD,CAAC;IAEF,oEAAoE;IACpE,MAAM,UAAU,GAAG;QACf,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE;YAClB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YACpB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,CAAC,GAAW,EAAE,EAAE;YACrB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,EAAE,CAAC,MAAc,EAAE,GAAG,OAAiB,EAAE,EAAE;YAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3C,QAAQ,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/C,MAAM,EAAE,CAAC,GAAW,EAAE,GAAW,EAAE,EAAE;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,yCAAyC;YACzC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACtE,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;KACJ,CAAC;IAEF,2BAA2B;IAC3B,MAAM,QAAQ,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,CAAC,EAAE,IAAI,CAAC,CAAC;KACZ,CAAC;IAEF,2BAA2B;IAC3B,MAAM,QAAQ,GAAG;QACb,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE;YACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,gDAAgD;YAChD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,SAAS,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KACvD,CAAC;IAEF,8DAA8D;IAC9D,MAAM,QAAQ,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;KAChB,CAAC;IAEF,MAAM,OAAO,GAA4B;QACrC,gBAAgB;QAChB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,QAAQ;QAEd,kDAAkD;QAClD,MAAM,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;QACrC,MAAM,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;QACrC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAEvC,wBAAwB;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;QACV,QAAQ;QAER,uBAAuB;QACvB,SAAS;QACT,SAAS;QACT,kBAAkB;QAClB,kBAAkB;QAElB,YAAY;QACZ,SAAS;QACT,GAAG;QACH,QAAQ;QAER,wBAAwB;QACxB,MAAM,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,GAAG;QACpC,MAAM,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI;QACtC,WAAW,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS;QAChD,QAAQ,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ;QACnD,QAAQ,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ;QACnD,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,SAAS;QACrD,QAAQ,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAEnE,wCAAwC;QACxC,GAAG,yBAAyB,CAAC,iBAAiB,CAAC;KAClD,CAAC;IAEF,mDAAmD;IACnD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACpC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,sBAAsB;QACtB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,SAAS;QACb,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAC9B,OAAgC;IAEhC,MAAM,SAAS,GAA4B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,sBAAsB;QACtB,IAAI,2BAAmB,CAAC,QAAQ,CAAC,GAAyC,CAAC,EAAE,CAAC;YAC1E,SAAS;QACb,CAAC;QAED,6CAA6C;QAC7C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,SAAS;QACb,CAAC;QAED,gDAAgD;QAChD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAC9B,uDAAuD;YACvD,SAAS,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAwC,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,SAAS,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACvB,EAAmC;IAEnC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpD,uCAAuC;IACvC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE;QAC1C,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACtB,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAmB,GAAM;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,UAAU,CAAC,KAAe,CAAC,CAAC;QAChC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/src/utils/encryption.utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * AES-256-GCM encryption for secrets at rest.
+ * Set DATAHUB_MASTER_KEY environment variable or provide via plugin configuration.
+ */
+export declare function isEncrypted(value: string): boolean;
+export declare function encryptSecret(plaintext: string, masterKey: string): string;
+export declare function decryptSecret(encryptedValue: string, masterKey: string): string;
+export declare function getMasterKey(envVarName?: string): string | undefined;
+export declare function isEncryptionConfigured(envVarName?: string): boolean;
+//# sourceMappingURL=encryption.utils.d.ts.map

package/dist/src/utils/encryption.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.utils.d.ts","sourceRoot":"","sources":["../../../src/utils/encryption.utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAMD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA0B1E;AAED,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAmC/E;AAED,wBAAgB,YAAY,CAAC,UAAU,SAAuB,GAAG,MAAM,GAAG,SAAS,CAElF;AAED,wBAAgB,sBAAsB,CAAC,UAAU,SAAuB,GAAG,OAAO,CAGjF"}

package/dist/src/utils/encryption.utils.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * AES-256-GCM encryption for secrets at rest.
+ * Set DATAHUB_MASTER_KEY environment variable or provide via plugin configuration.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isEncrypted = isEncrypted;
+exports.encryptSecret = encryptSecret;
+exports.decryptSecret = decryptSecret;
+exports.getMasterKey = getMasterKey;
+exports.isEncryptionConfigured = isEncryptionConfigured;
+const crypto = __importStar(require("crypto"));
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const AUTH_TAG_LENGTH = 16;
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 32;
+const ITERATIONS = 100000;
+// Encrypted value format: base64(salt + iv + authTag + ciphertext)
+const ENCRYPTED_PREFIX = 'enc:v1:';
+function isEncrypted(value) {
+    return value.startsWith(ENCRYPTED_PREFIX);
+}
+function deriveKey(masterKey, salt) {
+    return crypto.pbkdf2Sync(masterKey, salt, ITERATIONS, KEY_LENGTH, 'sha256');
+}
+function encryptSecret(plaintext, masterKey) {
+    if (!masterKey) {
+        throw new Error('Master encryption key is required for secret encryption');
+    }
+    // Generate random salt and IV
+    const salt = crypto.randomBytes(SALT_LENGTH);
+    const iv = crypto.randomBytes(IV_LENGTH);
+    // Derive key from master key
+    const key = deriveKey(masterKey, salt);
+    // Create cipher and encrypt
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    // Get auth tag for integrity verification
+    const authTag = cipher.getAuthTag();
+    // Combine: salt + iv + authTag + ciphertext
+    const combined = Buffer.concat([salt, iv, authTag, encrypted]);
+    return ENCRYPTED_PREFIX + combined.toString('base64');
+}
+function decryptSecret(encryptedValue, masterKey) {
+    if (!masterKey) {
+        throw new Error('Master encryption key is required for secret decryption');
+    }
+    if (!isEncrypted(encryptedValue)) {
+        throw new Error('Cannot decrypt value: not in encrypted format. All secrets must be encrypted with enc:v1: prefix.');
+    }
+    // Remove prefix and decode
+    const data = Buffer.from(encryptedValue.slice(ENCRYPTED_PREFIX.length), 'base64');
+    // Extract components
+    const salt = data.subarray(0, SALT_LENGTH);
+    const iv = data.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+    const authTag = data.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+    const ciphertext = data.subarray(SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+    // Derive key from master key
+    const key = deriveKey(masterKey, salt);
+    // Create decipher
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    // Decrypt
+    try {
+        const decrypted = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    catch (error) {
+        throw new Error('Failed to decrypt secret: invalid key or corrupted data');
+    }
+}
+function getMasterKey(envVarName = 'DATAHUB_MASTER_KEY') {
+    return process.env[envVarName];
+}
+function isEncryptionConfigured(envVarName = 'DATAHUB_MASTER_KEY') {
+    const key = process.env[envVarName];
+    return typeof key === 'string' && key.length >= 32;
+}
+//# sourceMappingURL=encryption.utils.js.map

package/dist/src/utils/encryption.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.utils.js","sourceRoot":"","sources":["../../../src/utils/encryption.utils.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcH,kCAEC;AAMD,sCA0BC;AAED,sCAmCC;AAED,oCAEC;AAED,wDAGC;AA5FD,+CAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEnC,SAAgB,WAAW,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB,EAAE,IAAY;IAC9C,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,SAAgB,aAAa,CAAC,SAAiB,EAAE,SAAiB;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IAED,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAEzC,6BAA6B;IAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAEvC,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAE/D,OAAO,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,aAAa,CAAC,cAAsB,EAAE,SAAiB;IACnE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;IACzH,CAAC;IAED,2BAA2B;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IAElF,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,SAAS,EAAE,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC,CAAC;IAE5E,6BAA6B;IAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAEvC,kBAAkB;IAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,UAAU;IACV,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;AACL,CAAC;AAED,SAAgB,YAAY,CAAC,UAAU,GAAG,oBAAoB;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,sBAAsB,CAAC,UAAU,GAAG,oBAAoB;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AACvD,CAAC"}

package/dist/src/utils/environment.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Check if running in a browser environment
+ */
+export declare const IS_BROWSER: boolean;
+//# sourceMappingURL=environment.d.ts.map

package/dist/src/utils/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/utils/environment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,UAAU,SACmE,CAAC"}