@portel/photon 1.4.1 → 1.6.0

package/dist/serv/session/store.js

@@ -0,0 +1,284 @@
+/**
+ * Session Store Interface and Implementations
+ *
+ * Provides session management for SERV with support for
+ * in-memory (development) and Redis (production) backends
+ */
+import { randomUUID } from 'crypto';
+const DEFAULT_CONFIG = {
+    defaultTtlSeconds: 15 * 60, // 15 minutes
+    maxTtlSeconds: 24 * 60 * 60, // 24 hours
+    cleanupIntervalMs: 5 * 60 * 1000, // 5 minutes
+};
+// ============================================================================
+// In-Memory Session Store (Development)
+// ============================================================================
+export class MemorySessionStore {
+    sessions = new Map();
+    userSessions = new Map(); // tenantId:userId -> sessionIds
+    cleanupTimer;
+    config;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.startCleanup();
+    }
+    async create(options) {
+        const now = new Date();
+        const ttl = Math.min(options.ttlSeconds ?? this.config.defaultTtlSeconds, this.config.maxTtlSeconds);
+        const session = {
+            id: randomUUID(),
+            tenantId: options.tenantId,
+            userId: options.userId,
+            clientId: options.clientId,
+            clientFingerprint: options.clientFingerprint,
+            createdAt: now,
+            expiresAt: new Date(now.getTime() + ttl * 1000),
+            lastActivityAt: now,
+        };
+        this.sessions.set(session.id, session);
+        // Track user sessions
+        if (options.userId) {
+            const key = `${options.tenantId}:${options.userId}`;
+            if (!this.userSessions.has(key)) {
+                this.userSessions.set(key, new Set());
+            }
+            this.userSessions.get(key).add(session.id);
+        }
+        return session;
+    }
+    async get(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return null;
+        // Check if expired
+        if (session.expiresAt.getTime() < Date.now()) {
+            await this.destroy(sessionId);
+            return null;
+        }
+        return session;
+    }
+    async getByUser(tenantId, userId) {
+        const key = `${tenantId}:${userId}`;
+        const sessionIds = this.userSessions.get(key);
+        if (!sessionIds)
+            return [];
+        const sessions = [];
+        for (const id of sessionIds) {
+            const session = await this.get(id);
+            if (session)
+                sessions.push(session);
+        }
+        return sessions;
+    }
+    async touch(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return;
+        const now = new Date();
+        const ttl = this.config.defaultTtlSeconds;
+        const maxExpiry = new Date(session.createdAt.getTime() + this.config.maxTtlSeconds * 1000);
+        const newExpiry = new Date(Math.min(now.getTime() + ttl * 1000, maxExpiry.getTime()));
+        session.lastActivityAt = now;
+        session.expiresAt = newExpiry;
+    }
+    async destroy(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (session?.userId) {
+            const key = `${session.tenantId}:${session.userId}`;
+            this.userSessions.get(key)?.delete(sessionId);
+        }
+        this.sessions.delete(sessionId);
+    }
+    async destroyByUser(tenantId, userId) {
+        const key = `${tenantId}:${userId}`;
+        const sessionIds = this.userSessions.get(key);
+        if (!sessionIds)
+            return 0;
+        const count = sessionIds.size;
+        for (const id of sessionIds) {
+            this.sessions.delete(id);
+        }
+        this.userSessions.delete(key);
+        return count;
+    }
+    async cleanup() {
+        const now = Date.now();
+        let cleaned = 0;
+        for (const [id, session] of this.sessions) {
+            if (session.expiresAt.getTime() < now) {
+                await this.destroy(id);
+                cleaned++;
+            }
+        }
+        return cleaned;
+    }
+    async close() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+        }
+        this.sessions.clear();
+        this.userSessions.clear();
+    }
+    startCleanup() {
+        this.cleanupTimer = setInterval(() => {
+            this.cleanup().catch(console.error);
+        }, this.config.cleanupIntervalMs);
+    }
+}
+export class RedisSessionStore {
+    redis;
+    keyPrefix;
+    config;
+    cleanupTimer;
+    constructor(options) {
+        if (typeof options.redis === 'string') {
+            throw new Error('Redis URL not supported yet - pass a Redis client instance');
+        }
+        this.redis = options.redis;
+        this.keyPrefix = options.keyPrefix ?? 'serv:session:';
+        this.config = { ...DEFAULT_CONFIG, ...options.config };
+        this.startCleanup();
+    }
+    sessionKey(id) {
+        return `${this.keyPrefix}${id}`;
+    }
+    userSessionsKey(tenantId, userId) {
+        return `${this.keyPrefix}user:${tenantId}:${userId}`;
+    }
+    async create(options) {
+        const now = new Date();
+        const ttl = Math.min(options.ttlSeconds ?? this.config.defaultTtlSeconds, this.config.maxTtlSeconds);
+        const session = {
+            id: randomUUID(),
+            tenantId: options.tenantId,
+            userId: options.userId,
+            clientId: options.clientId,
+            clientFingerprint: options.clientFingerprint,
+            createdAt: now,
+            expiresAt: new Date(now.getTime() + ttl * 1000),
+            lastActivityAt: now,
+        };
+        await this.redis.set(this.sessionKey(session.id), JSON.stringify(session), { EX: ttl });
+        // Track user sessions
+        if (options.userId) {
+            const userKey = this.userSessionsKey(options.tenantId, options.userId);
+            await this.redis.sadd(userKey, session.id);
+            await this.redis.expire(userKey, this.config.maxTtlSeconds);
+        }
+        return session;
+    }
+    async get(sessionId) {
+        const data = await this.redis.get(this.sessionKey(sessionId));
+        if (!data)
+            return null;
+        const session = JSON.parse(data);
+        session.createdAt = new Date(session.createdAt);
+        session.expiresAt = new Date(session.expiresAt);
+        session.lastActivityAt = new Date(session.lastActivityAt);
+        // Check if expired (Redis TTL should handle this, but double-check)
+        if (session.expiresAt.getTime() < Date.now()) {
+            await this.destroy(sessionId);
+            return null;
+        }
+        return session;
+    }
+    async getByUser(tenantId, userId) {
+        const userKey = this.userSessionsKey(tenantId, userId);
+        const sessionIds = await this.redis.smembers(userKey);
+        const sessions = [];
+        for (const id of sessionIds) {
+            const session = await this.get(id);
+            if (session) {
+                sessions.push(session);
+            }
+            else {
+                // Clean up stale reference
+                await this.redis.srem(userKey, id);
+            }
+        }
+        return sessions;
+    }
+    async touch(sessionId) {
+        const session = await this.get(sessionId);
+        if (!session)
+            return;
+        const now = new Date();
+        const ttl = this.config.defaultTtlSeconds;
+        const maxExpiry = new Date(session.createdAt.getTime() + this.config.maxTtlSeconds * 1000);
+        const newExpiry = new Date(Math.min(now.getTime() + ttl * 1000, maxExpiry.getTime()));
+        const remainingTtl = Math.floor((newExpiry.getTime() - now.getTime()) / 1000);
+        session.lastActivityAt = now;
+        session.expiresAt = newExpiry;
+        await this.redis.set(this.sessionKey(sessionId), JSON.stringify(session), { EX: remainingTtl });
+    }
+    async destroy(sessionId) {
+        const session = await this.get(sessionId);
+        if (session?.userId) {
+            const userKey = this.userSessionsKey(session.tenantId, session.userId);
+            await this.redis.srem(userKey, sessionId);
+        }
+        await this.redis.del(this.sessionKey(sessionId));
+    }
+    async destroyByUser(tenantId, userId) {
+        const userKey = this.userSessionsKey(tenantId, userId);
+        const sessionIds = await this.redis.smembers(userKey);
+        if (sessionIds.length === 0)
+            return 0;
+        const keys = sessionIds.map((id) => this.sessionKey(id));
+        await this.redis.del(keys);
+        await this.redis.del(userKey);
+        return sessionIds.length;
+    }
+    async cleanup() {
+        // Redis TTL handles cleanup automatically
+        // This method exists for interface compatibility
+        return 0;
+    }
+    async close() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+        }
+        await this.redis.quit();
+    }
+    startCleanup() {
+        // Redis handles TTL-based cleanup automatically
+        // We just periodically clean up stale user session references
+        this.cleanupTimer = setInterval(async () => {
+            try {
+                const userKeys = await this.redis.keys(`${this.keyPrefix}user:*`);
+                for (const userKey of userKeys) {
+                    const sessionIds = await this.redis.smembers(userKey);
+                    for (const id of sessionIds) {
+                        const exists = await this.redis.get(this.sessionKey(id));
+                        if (!exists) {
+                            await this.redis.srem(userKey, id);
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                console.error('Session cleanup error:', err);
+            }
+        }, this.config.cleanupIntervalMs);
+    }
+}
+export function createSessionStore(options) {
+    switch (options.type) {
+        case 'memory':
+            return new MemorySessionStore(options.config);
+        case 'redis':
+            if (!options.redis) {
+                throw new Error('Redis client required for redis session store');
+            }
+            return new RedisSessionStore({
+                redis: options.redis,
+                config: options.config,
+            });
+        case 'kv':
+            // KV store is imported separately to avoid bundling Cloudflare types
+            throw new Error('Use KVSessionStore directly from session/kv-store.ts');
+        default:
+            throw new Error(`Unknown session store type: ${options.type}`);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/serv/session/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/serv/session/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AA8DpC,MAAM,cAAc,GAAkB;IACpC,iBAAiB,EAAE,EAAE,GAAG,EAAE,EAAE,aAAa;IACzC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW;IACxC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,YAAY;CAC/C,CAAC;AAEF,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,MAAM,OAAO,kBAAkB;IACrB,QAAQ,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC3C,YAAY,GAA6B,IAAI,GAAG,EAAE,CAAC,CAAC,gCAAgC;IACpF,YAAY,CAAkB;IAC9B,MAAM,CAAgB;IAE9B,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA6B;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;YAC/C,cAAc,EAAE,GAAG;SACpB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAEvC,sBAAsB;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,mBAAmB;QACnB,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,MAAc;QAC9C,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAEtF,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;QAC7B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC;QAE1B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;CACF;AA4BD,MAAM,OAAO,iBAAiB;IACpB,KAAK,CAAc;IACnB,SAAS,CAAS;IAClB,MAAM,CAAgB;IACtB,YAAY,CAAkB;IAEtC,YAAY,OAAiC;QAC3C,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,EAAU;QAC3B,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC;IAClC,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,MAAc;QACtD,OAAO,GAAG,IAAI,CAAC,SAAS,QAAQ,QAAQ,IAAI,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA6B;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;YAC/C,cAAc,EAAE,GAAG;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAExF,sBAAsB;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC5C,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE1D,oEAAoE;QACpE,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,MAAc;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,2BAA2B;gBAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAE9E,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;QAC7B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAE9B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,0CAA0C;QAC1C,iDAAiD;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,YAAY;QAClB,gDAAgD;QAChD,8DAA8D;QAC9D,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YACzC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,QAAQ,CAAC,CAAC;gBAClE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACtD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;wBAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;wBACzD,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;wBACrC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;CACF;AAeD,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,OAAO;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,KAAK,IAAI;YACP,qEAAqE;YACrE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E;YACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/serv/types/index.d.ts

@@ -0,0 +1,147 @@
+/**
+ * SERV Core Types
+ *
+ * Type definitions for the hosted Photon MCP platform
+ */
+export interface Tenant {
+    id: string;
+    name: string;
+    slug: string;
+    region: string;
+    plan: 'free' | 'pro' | 'enterprise';
+    encryptionKeyId: string;
+    settings: TenantSettings;
+    createdAt: Date;
+}
+export interface TenantSettings {
+    allowAnonymousUsers: boolean;
+    sponsoredPhotons: string[];
+    customDomain?: string;
+    rateLimit?: {
+        requestsPerMinute: number;
+        requestsPerDay: number;
+    };
+}
+export interface User {
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    createdAt: Date;
+}
+export interface Membership {
+    tenantId: string;
+    userId: string;
+    role: 'owner' | 'admin' | 'member' | 'viewer';
+    status: 'active' | 'pending' | 'suspended';
+    invitedBy?: string;
+    joinedAt: Date;
+}
+export interface Session {
+    id: string;
+    tenantId: string;
+    userId?: string;
+    clientId: string;
+    clientFingerprint?: string;
+    createdAt: Date;
+    expiresAt: Date;
+    lastActivityAt: Date;
+}
+export interface SessionToken {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    jti: string;
+    tenant_id: string;
+    tenant_slug: string;
+    user_id?: string;
+    role?: string;
+    mcp_session_id: string;
+}
+export interface SessionCreateOptions {
+    tenantId: string;
+    userId?: string;
+    clientId: string;
+    clientFingerprint?: string;
+    ttlSeconds?: number;
+}
+export interface OAuthProvider {
+    id: string;
+    name: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    userInfoUrl?: string;
+    scopes: string[];
+    clientId: string;
+    clientSecret: string;
+}
+export interface OAuthToken {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    expiresIn: number;
+    scope?: string;
+}
+export interface PhotonGrant {
+    id: string;
+    tenantId: string;
+    userId?: string;
+    photonId: string;
+    provider: string;
+    scopes: string[];
+    accessTokenEncrypted: string;
+    refreshTokenEncrypted?: string;
+    tokenExpiresAt: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface ElicitationRequest {
+    id: string;
+    sessionId: string;
+    photonId: string;
+    provider: string;
+    requiredScopes: string[];
+    status: 'pending' | 'completed' | 'expired' | 'cancelled';
+    redirectUri: string;
+    codeVerifier?: string;
+    createdAt: Date;
+    expiresAt: Date;
+}
+export interface ElicitationError {
+    code: number;
+    message: string;
+    data: {
+        url: string;
+        elicitationId: string;
+        provider: string;
+        scopes: string[];
+    };
+}
+export declare const URL_ELICITATION_ERROR_CODE = -32001;
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported?: string[];
+    resource_signing_alg_values_supported?: string[];
+    resource_documentation?: string;
+}
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    jwks_uri?: string;
+    scopes_supported?: string[];
+    response_types_supported: string[];
+    grant_types_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+}
+export interface RequestContext {
+    tenant: Tenant;
+    session?: Session;
+    user?: User;
+    membership?: Membership;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/serv/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/serv/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE;QACV,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAMD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAE3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IAGZ,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAGD,eAAO,MAAM,0BAA0B,SAAS,CAAC;AAMjD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;CAClD;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB"}

package/dist/serv/types/index.js

@@ -0,0 +1,8 @@
+/**
+ * SERV Core Types
+ *
+ * Type definitions for the hosted Photon MCP platform
+ */
+// JSONRPC error code for URL elicitation
+export const URL_ELICITATION_ERROR_CODE = -32001;
+//# sourceMappingURL=index.js.map

package/dist/serv/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/serv/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwJH,yCAAyC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAAK,CAAC"}

package/dist/serv/vault/token-vault.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Token Vault
+ *
+ * Secure encrypted storage for OAuth tokens with per-tenant encryption keys
+ * Uses AES-256-GCM for authenticated encryption
+ */
+export interface TokenVault {
+    /**
+     * Encrypt a token for storage
+     */
+    encrypt(tenantId: string, plaintext: string): Promise<string>;
+    /**
+     * Decrypt a stored token
+     */
+    decrypt(tenantId: string, ciphertext: string): Promise<string>;
+    /**
+     * Rotate the encryption key for a tenant
+     */
+    rotateKey?(tenantId: string): Promise<void>;
+}
+export interface TokenVaultConfig {
+    /** Master key for deriving tenant keys (min 32 bytes) */
+    masterKey: string;
+    /** Salt for key derivation */
+    salt?: string;
+    /** Key derivation iterations (default: 100000) */
+    iterations?: number;
+}
+/**
+ * Simple token vault using derived keys from a master key
+ * Suitable for development or single-instance deployments
+ *
+ * For production multi-instance, use KmsTokenVault with AWS KMS/GCP KMS/HashiCorp Vault
+ */
+export declare class LocalTokenVault implements TokenVault {
+    private masterKey;
+    private salt;
+    private keyCache;
+    private iterations;
+    constructor(config: TokenVaultConfig);
+    encrypt(tenantId: string, plaintext: string): Promise<string>;
+    decrypt(tenantId: string, ciphertext: string): Promise<string>;
+    /**
+     * Derive a tenant-specific key from the master key
+     */
+    private deriveKey;
+    /**
+     * Clear the key cache (call after key rotation)
+     */
+    clearCache(): void;
+}
+export interface KmsClient {
+    /**
+     * Encrypt data using a KMS key
+     */
+    encrypt(keyId: string, plaintext: Buffer): Promise<Buffer>;
+    /**
+     * Decrypt data using a KMS key
+     */
+    decrypt(keyId: string, ciphertext: Buffer): Promise<Buffer>;
+    /**
+     * Generate a data key for envelope encryption
+     */
+    generateDataKey(keyId: string): Promise<{
+        plaintext: Buffer;
+        ciphertext: Buffer;
+    }>;
+}
+export interface KmsTokenVaultConfig {
+    /** KMS client instance */
+    kms: KmsClient;
+    /** Function to get the KMS key ID for a tenant */
+    getKeyId: (tenantId: string) => Promise<string>;
+}
+/**
+ * Token vault using external KMS (AWS KMS, GCP KMS, etc.)
+ * Uses envelope encryption for efficiency
+ */
+export declare class KmsTokenVault implements TokenVault {
+    private kms;
+    private getKeyId;
+    private dataKeyCache;
+    constructor(config: KmsTokenVaultConfig);
+    encrypt(tenantId: string, plaintext: string): Promise<string>;
+    decrypt(tenantId: string, ciphertext: string): Promise<string>;
+    rotateKey(tenantId: string): Promise<void>;
+    /**
+     * Get or generate a data key for envelope encryption
+     */
+    private getDataKey;
+}
+export type TokenVaultType = 'local' | 'kms';
+export interface CreateTokenVaultOptions {
+    type: TokenVaultType;
+    masterKey?: string;
+    kms?: KmsClient;
+    getKeyId?: (tenantId: string) => Promise<string>;
+}
+export declare function createTokenVault(options: CreateTokenVaultOptions): TokenVault;
+export declare function getTokenVault(): TokenVault;
+export declare function initTokenVault(options: CreateTokenVaultOptions): TokenVault;
+//# sourceMappingURL=token-vault.d.ts.map

package/dist/serv/vault/token-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-vault.d.ts","sourceRoot":"","sources":["../../../src/serv/vault/token-vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D;;OAEG;IACH,SAAS,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAMD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,UAAU,CAAS;gBAEf,MAAM,EAAE,gBAAgB;IAU9B,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa7D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBpE;;OAEG;IACH,OAAO,CAAC,SAAS;IAkBjB;;OAEG;IACH,UAAU,IAAI,IAAI;CAGnB;AAMD,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3D;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5D;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,mBAAmB;IAClC,0BAA0B;IAC1B,GAAG,EAAE,SAAS,CAAC;IACf,kDAAkD;IAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;GAGG;AACH,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,YAAY,CACR;gBAEA,MAAM,EAAE,mBAAmB;IAKjC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB7D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuB9D,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD;;OAEG;YACW,UAAU;CAuBzB;AAMD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,CAAC;AAE7C,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,UAAU,CAoB7E;AAQD,wBAAgB,aAAa,IAAI,UAAU,CAK1C;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG,UAAU,CAG3E"}