@revealui/core 0.0.1-pre.4 → 0.2.1

package/dist/security/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/security/authorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,UAAU,EAAE,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,UAAU,CAAA;IACvE,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACrC,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACrC,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,IAAI,CAAA;QACX,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAiC;IAEjD;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI9B;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIzC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIpC;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAY7E;;OAEG;IACH,WAAW,CACT,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyBxC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA4B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAgBvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAInE;;OAEG;IACH,KAAK,IAAI,IAAI;CAId;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,qBAA4B,CAAA;AAEtD;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BvB,CAAA;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,UAAU,CAA0B;IAE5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKhC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAKrD,KAAK,IAAI,UAAU;CAOpB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAKb;IAED,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAKpB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxB,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,IAAI;IAKZ,SAAS,CAAC,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAKvC,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAKnC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IASrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKhC,KAAK,IAAI,MAAM;CAOhB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IACxD,SAAS,MAAM,EAAE,cAAc,MAAM,EAAE,YAAY,kBAAkB,wBAe9E;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,cAAc,MAAM,EAAE,YAAY,kBAAkB,wBAe9E;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAAG,OAAO,EAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,IAEN,SAAS,QAAQ,EAAE,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,sBASxD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE;IACR,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,EACD,MAAM,EAAE,MAAM,GACb,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3C,OAAO,CAgBT;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAkE;IAC/E,OAAO,CAAC,GAAG,CAAQ;gBAEP,GAAG,GAAE,MAAe;IAKhC;;OAEG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAiB1E;;OAEG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAS7E;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ/B;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,OAAO,CAAC,WAAW;CAGpB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,iBAAwB,CAAA"}

package/dist/security/authorization.js

@@ -0,0 +1,434 @@
+/**
+ * Authorization System
+ *
+ * Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)
+ */
+/**
+ * Authorization system
+ */
+export class AuthorizationSystem {
+    roles = new Map();
+    policies = new Map();
+    /**
+     * Register role
+     */
+    registerRole(role) {
+        this.roles.set(role.id, role);
+    }
+    /**
+     * Get role
+     */
+    getRole(roleId) {
+        return this.roles.get(roleId);
+    }
+    /**
+     * Register policy
+     */
+    registerPolicy(policy) {
+        this.policies.set(policy.id, policy);
+    }
+    /**
+     * Check if user has permission (RBAC)
+     */
+    hasPermission(userRoles, resource, action) {
+        // Get all permissions for user's roles
+        const permissions = this.getUserPermissions(userRoles);
+        // Check if any permission matches
+        return permissions.some((permission) => this.matchesResource(permission.resource, resource) &&
+            this.matchesAction(permission.action, action));
+    }
+    /**
+     * Check access with policies (ABAC)
+     */
+    checkAccess(context, resource, action) {
+        // Check RBAC first
+        if (this.hasPermission(context.user.roles, resource, action)) {
+            return { allowed: true };
+        }
+        // Check policies
+        const applicablePolicies = this.getApplicablePolicies(resource, action, context);
+        // Sort by priority (higher priority first)
+        applicablePolicies.sort((a, b) => (b.priority || 0) - (a.priority || 0));
+        // Apply first matching policy
+        for (const policy of applicablePolicies) {
+            if (this.evaluateConditions(policy.conditions || [], context)) {
+                return {
+                    allowed: policy.effect === 'allow',
+                    reason: policy.effect === 'deny' ? `Denied by policy: ${policy.name}` : undefined,
+                };
+            }
+        }
+        return { allowed: false, reason: 'No matching policy' };
+    }
+    /**
+     * Get all permissions for roles
+     */
+    getUserPermissions(roleIds) {
+        const permissions = [];
+        const visited = new Set();
+        const addRolePermissions = (roleId) => {
+            if (visited.has(roleId))
+                return;
+            visited.add(roleId);
+            const role = this.roles.get(roleId);
+            if (!role)
+                return;
+            // Add role permissions
+            permissions.push(...role.permissions);
+            // Add inherited permissions
+            if (role.inherits) {
+                role.inherits.forEach((inheritedRoleId) => {
+                    addRolePermissions(inheritedRoleId);
+                });
+            }
+        };
+        roleIds.forEach(addRolePermissions);
+        return permissions;
+    }
+    /**
+     * Get applicable policies
+     */
+    getApplicablePolicies(resource, action, _context) {
+        return Array.from(this.policies.values()).filter((policy) => {
+            // Check if resource matches
+            const resourceMatches = policy.resources.some((r) => this.matchesResource(r, resource));
+            // Check if action matches
+            const actionMatches = policy.actions.some((a) => this.matchesAction(a, action));
+            return resourceMatches && actionMatches;
+        });
+    }
+    /**
+     * Match resource pattern
+     */
+    matchesResource(pattern, resource) {
+        if (pattern === '*')
+            return true;
+        if (pattern === resource)
+            return true;
+        // Convert glob pattern to regex
+        const regex = new RegExp(`^${pattern.replace(/\./g, '\\.').replace(/\*/g, '.*').replace(/\?/g, '.')}$`);
+        return regex.test(resource);
+    }
+    /**
+     * Match action pattern
+     */
+    matchesAction(pattern, action) {
+        if (pattern === '*')
+            return true;
+        if (pattern === action)
+            return true;
+        // Support wildcards like "read:*"
+        const regex = new RegExp(`^${pattern.replace(/\./g, '\\.').replace(/\*/g, '.*').replace(/\?/g, '.')}$`);
+        return regex.test(action);
+    }
+    /**
+     * Evaluate policy conditions
+     */
+    evaluateConditions(conditions, context) {
+        return conditions.every((condition) => {
+            const value = this.getContextValue(condition.field, context);
+            return this.evaluateCondition(condition, value);
+        });
+    }
+    /**
+     * Get value from context
+     */
+    getContextValue(field, context) {
+        const parts = field.split('.');
+        let value = context;
+        for (const part of parts) {
+            if (value && typeof value === 'object' && part in value) {
+                value = value[part];
+            }
+            else {
+                return undefined;
+            }
+        }
+        return value;
+    }
+    /**
+     * Evaluate single condition
+     */
+    evaluateCondition(condition, value) {
+        switch (condition.operator) {
+            case 'eq':
+                return value === condition.value;
+            case 'ne':
+                return value !== condition.value;
+            case 'gt':
+                return typeof value === 'number' && value > condition.value;
+            case 'gte':
+                return typeof value === 'number' && value >= condition.value;
+            case 'lt':
+                return typeof value === 'number' && value < condition.value;
+            case 'lte':
+                return typeof value === 'number' && value <= condition.value;
+            case 'in':
+                return Array.isArray(condition.value) && condition.value.includes(value);
+            case 'contains':
+                return (typeof value === 'string' &&
+                    typeof condition.value === 'string' &&
+                    value.includes(condition.value));
+            default:
+                return false;
+        }
+    }
+    /**
+     * Check if user owns resource
+     */
+    ownsResource(userId, resource) {
+        return resource.owner === userId;
+    }
+    /**
+     * Clear all roles and policies
+     */
+    clear() {
+        this.roles.clear();
+        this.policies.clear();
+    }
+}
+/**
+ * Global authorization instance
+ */
+export const authorization = new AuthorizationSystem();
+/**
+ * Common roles
+ */
+export const CommonRoles = {
+    admin: {
+        id: 'admin',
+        name: 'Administrator',
+        description: 'Full system access',
+        permissions: [{ resource: '*', action: '*' }],
+    },
+    user: {
+        id: 'user',
+        name: 'User',
+        description: 'Standard user access',
+        permissions: [
+            { resource: 'profile', action: 'read' },
+            { resource: 'profile', action: 'update' },
+            { resource: 'posts', action: 'read' },
+            { resource: 'posts', action: 'create' },
+        ],
+    },
+    guest: {
+        id: 'guest',
+        name: 'Guest',
+        description: 'Public access',
+        permissions: [
+            { resource: 'posts', action: 'read' },
+            { resource: 'public', action: 'read' },
+        ],
+    },
+};
+/**
+ * Permission builder
+ */
+export class PermissionBuilder {
+    permission = {};
+    resource(resource) {
+        this.permission.resource = resource;
+        return this;
+    }
+    action(action) {
+        this.permission.action = action;
+        return this;
+    }
+    conditions(conditions) {
+        this.permission.conditions = conditions;
+        return this;
+    }
+    build() {
+        if (!(this.permission.resource && this.permission.action)) {
+            throw new Error('Resource and action are required');
+        }
+        return this.permission;
+    }
+}
+/**
+ * Policy builder
+ */
+export class PolicyBuilder {
+    policy = {
+        effect: 'allow',
+        resources: [],
+        actions: [],
+        conditions: [],
+    };
+    id(id) {
+        this.policy.id = id;
+        return this;
+    }
+    name(name) {
+        this.policy.name = name;
+        return this;
+    }
+    allow() {
+        this.policy.effect = 'allow';
+        return this;
+    }
+    deny() {
+        this.policy.effect = 'deny';
+        return this;
+    }
+    resources(...resources) {
+        this.policy.resources = resources;
+        return this;
+    }
+    actions(...actions) {
+        this.policy.actions = actions;
+        return this;
+    }
+    condition(field, operator, value) {
+        if (!this.policy.conditions) {
+            this.policy.conditions = [];
+        }
+        this.policy.conditions.push({ field, operator, value });
+        return this;
+    }
+    priority(priority) {
+        this.policy.priority = priority;
+        return this;
+    }
+    build() {
+        if (!(this.policy.id && this.policy.name)) {
+            throw new Error('ID and name are required');
+        }
+        return this.policy;
+    }
+}
+/**
+ * Authorization decorators
+ */
+export function RequirePermission(resource, action) {
+    return (_target, _propertyKey, descriptor) => {
+        const originalMethod = descriptor.value;
+        descriptor.value = function (...args) {
+            const userRoles = this.user?.roles || [];
+            if (!authorization.hasPermission(userRoles, resource, action)) {
+                throw new Error(`Permission denied: ${resource}:${action}`);
+            }
+            return originalMethod.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+export function RequireRole(requiredRole) {
+    return (_target, _propertyKey, descriptor) => {
+        const originalMethod = descriptor.value;
+        descriptor.value = function (...args) {
+            const userRoles = this.user?.roles || [];
+            if (!userRoles.includes(requiredRole)) {
+                throw new Error(`Role required: ${requiredRole}`);
+            }
+            return originalMethod.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+/**
+ * Authorization middleware
+ */
+export function createAuthorizationMiddleware(getUser, resource, action) {
+    return (request, next) => {
+        const user = getUser(request);
+        if (!authorization.hasPermission(user.roles, resource, action)) {
+            throw new Error(`Permission denied: ${resource}:${action}`);
+        }
+        return next();
+    };
+}
+/**
+ * Resource ownership check
+ */
+export function canAccessResource(userId, userRoles, resource, action) {
+    // Check if user has permission
+    if (authorization.hasPermission(userRoles, resource.type, action)) {
+        return true;
+    }
+    // Check if user owns the resource
+    if (authorization.ownsResource(userId, resource)) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Attribute-based access control helper
+ */
+export function checkAttributeAccess(context, resource, action, requiredAttributes) {
+    // Check basic permission
+    const { allowed } = authorization.checkAccess(context, resource, action);
+    if (!allowed) {
+        return false;
+    }
+    // Check required attributes
+    if (requiredAttributes) {
+        const userAttributes = context.user.attributes || {};
+        return Object.entries(requiredAttributes).every(([key, value]) => userAttributes[key] === value);
+    }
+    return true;
+}
+/**
+ * Permission cache for performance
+ */
+export class PermissionCache {
+    cache = new Map();
+    ttl;
+    constructor(ttl = 300000) {
+        // 5 minutes default
+        this.ttl = ttl;
+    }
+    /**
+     * Get cached permission
+     */
+    get(userId, resource, action) {
+        const key = this.getCacheKey(userId, resource, action);
+        const cached = this.cache.get(key);
+        if (!cached) {
+            return undefined;
+        }
+        // Check expiration
+        if (Date.now() > cached.expiresAt) {
+            this.cache.delete(key);
+            return undefined;
+        }
+        return cached.allowed;
+    }
+    /**
+     * Set cached permission
+     */
+    set(userId, resource, action, allowed) {
+        const key = this.getCacheKey(userId, resource, action);
+        this.cache.set(key, {
+            allowed,
+            expiresAt: Date.now() + this.ttl,
+        });
+    }
+    /**
+     * Clear cache for user
+     */
+    clearUser(userId) {
+        for (const key of this.cache.keys()) {
+            if (key.startsWith(`${userId}:`)) {
+                this.cache.delete(key);
+            }
+        }
+    }
+    /**
+     * Clear all cache
+     */
+    clear() {
+        this.cache.clear();
+    }
+    /**
+     * Get cache key
+     */
+    getCacheKey(userId, resource, action) {
+        return `${userId}:${resource}:${action}`;
+    }
+}
+/**
+ * Global permission cache
+ */
+export const permissionCache = new PermissionCache();

package/dist/security/encryption.d.ts

@@ -0,0 +1,214 @@
+/**
+ * Encryption Utilities
+ *
+ * Data encryption for at-rest and in-transit protection
+ */
+export interface EncryptionConfig {
+    algorithm: 'AES-GCM' | 'AES-CBC' | 'AES-CTR';
+    keySize: 128 | 192 | 256;
+    ivSize?: number;
+}
+export interface EncryptedData {
+    data: string;
+    iv: string;
+    tag?: string;
+    algorithm: string;
+}
+/**
+ * Encryption system
+ */
+export declare class EncryptionSystem {
+    private config;
+    private keys;
+    constructor(config?: Partial<EncryptionConfig>);
+    /**
+     * Generate encryption key
+     */
+    generateKey(keyId?: string): Promise<CryptoKey>;
+    /**
+     * Import key from raw data
+     */
+    importKey(keyData: ArrayBuffer, keyId?: string): Promise<CryptoKey>;
+    /**
+     * Export key to raw data
+     */
+    exportKey(key: CryptoKey): Promise<ArrayBuffer>;
+    /**
+     * Encrypt data
+     */
+    encrypt(data: string, keyOrId: CryptoKey | string): Promise<EncryptedData>;
+    /**
+     * Decrypt data
+     */
+    decrypt(encryptedData: EncryptedData, keyOrId: CryptoKey | string): Promise<string>;
+    /**
+     * Encrypt object
+     */
+    encryptObject<T extends Record<string, unknown>>(obj: T, keyOrId: CryptoKey | string): Promise<EncryptedData>;
+    /**
+     * Decrypt object
+     */
+    decryptObject<T extends Record<string, unknown>>(encryptedData: EncryptedData, keyOrId: CryptoKey | string): Promise<T>;
+    /**
+     * Hash data
+     */
+    hash(data: string, algorithm?: 'SHA-256' | 'SHA-384' | 'SHA-512'): Promise<string>;
+    /**
+     * Generate random bytes
+     */
+    randomBytes(length: number): Uint8Array;
+    /**
+     * Generate random string
+     */
+    randomString(length: number, charset?: string): string;
+    /**
+     * Convert ArrayBuffer to base64
+     */
+    private arrayBufferToBase64;
+    /**
+     * Convert base64 to ArrayBuffer
+     */
+    private base64ToArrayBuffer;
+    /**
+     * Store key
+     */
+    storeKey(keyId: string, key: CryptoKey): void;
+    /**
+     * Get key
+     */
+    getKey(keyId: string): CryptoKey | undefined;
+    /**
+     * Remove key
+     */
+    removeKey(keyId: string): void;
+    /**
+     * Clear all keys
+     */
+    clearKeys(): void;
+}
+/**
+ * Global encryption instance
+ */
+export declare const encryption: EncryptionSystem;
+/**
+ * Field-level encryption
+ */
+export declare class FieldEncryption {
+    private encryption;
+    private key;
+    constructor(encryption: EncryptionSystem);
+    /**
+     * Initialize with key
+     */
+    initialize(key: CryptoKey): Promise<void>;
+    /**
+     * Encrypt field
+     */
+    encryptField(value: unknown): Promise<EncryptedData>;
+    /**
+     * Decrypt field
+     */
+    decryptField(encryptedData: EncryptedData): Promise<unknown>;
+    /**
+     * Encrypt object fields
+     */
+    encryptFields<T extends Record<string, unknown>>(obj: T, fields: (keyof T)[]): Promise<T>;
+    /**
+     * Decrypt object fields
+     */
+    decryptFields<T extends Record<string, unknown>>(obj: T, fields: (keyof T)[]): Promise<T>;
+}
+/**
+ * Key rotation
+ */
+export declare class KeyRotationManager {
+    private encryption;
+    private currentKeyId;
+    private oldKeys;
+    constructor(encryption: EncryptionSystem, initialKeyId: string);
+    /**
+     * Rotate to new key
+     */
+    rotate(newKeyId: string, newKey: CryptoKey): Promise<void>;
+    /**
+     * Re-encrypt data with new key
+     */
+    reencrypt(encryptedData: EncryptedData, oldKeyId: string): Promise<EncryptedData>;
+    /**
+     * Get current key ID
+     */
+    getCurrentKeyId(): string;
+    /**
+     * Clean up old keys
+     */
+    cleanupOldKeys(_olderThan: Date): void;
+}
+/**
+ * Envelope encryption for large data
+ */
+export declare class EnvelopeEncryption {
+    private encryption;
+    private masterKey;
+    constructor(encryption: EncryptionSystem, masterKey: CryptoKey);
+    /**
+     * Encrypt with envelope encryption
+     */
+    encrypt(data: string): Promise<{
+        encryptedData: EncryptedData;
+        encryptedKey: EncryptedData;
+    }>;
+    /**
+     * Decrypt with envelope encryption
+     */
+    decrypt(encryptedData: EncryptedData, encryptedKey: EncryptedData): Promise<string>;
+    private arrayBufferToBase64;
+    private base64ToArrayBuffer;
+}
+/**
+ * Data masking utilities
+ */
+export declare class DataMasking {
+    /**
+     * Mask email
+     */
+    static maskEmail(email: string): string;
+    /**
+     * Mask phone number
+     */
+    static maskPhone(phone: string): string;
+    /**
+     * Mask credit card
+     */
+    static maskCreditCard(card: string): string;
+    /**
+     * Mask SSN
+     */
+    static maskSSN(ssn: string): string;
+    /**
+     * Mask string (keep first and last character)
+     */
+    static maskString(str: string, keepChars?: number): string;
+}
+/**
+ * Secure random token generator
+ */
+export declare class TokenGenerator {
+    /**
+     * Generate secure token. `length` is the number of random bytes;
+     * the returned string is hex-encoded, so it will be `length * 2` characters.
+     */
+    static generate(length?: number): string;
+    /**
+     * Generate UUID v4
+     */
+    static generateUUID(): string;
+    /**
+     * Generate API key
+     */
+    static generateAPIKey(prefix?: string): string;
+    /**
+     * Generate session ID
+     */
+    static generateSessionID(): string;
+}
+//# sourceMappingURL=encryption.d.ts.map

package/dist/security/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/security/encryption.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;IAC5C,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAQD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,IAAI,CAAoC;gBAEpC,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAIlD;;OAEG;IACG,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAsBrD;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAwBzE;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IASrD;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAyChF;;OAEG;IACG,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgCzF;;OAEG;IACG,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnD,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,SAAS,GAAG,MAAM,GAC1B,OAAO,CAAC,aAAa,CAAC;IAKzB;;OAEG;IACG,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnD,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,SAAS,GAAG,MAAM,GAC1B,OAAO,CAAC,CAAC,CAAC;IAKb;;OAEG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAAS,GAAG,SAAS,GAAG,SAAqB,GACvD,OAAO,CAAC,MAAM,CAAC;IAalB;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASvC;;OAEG;IACH,YAAY,CACV,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAyE,GACjF,MAAM;IAiBT;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI;IAI7C;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI5C;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI9B;;OAEG;IACH,SAAS,IAAI,IAAI;CAGlB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU,kBAAyB,CAAA;AAEhD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,GAAG,CAAyB;gBAExB,UAAU,EAAE,gBAAgB;IAIxC;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAS1D;;OAEG;IACG,YAAY,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAelE;;OAEG;IACG,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAY/F;;OAEG;IACG,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;CAchG;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,YAAY,CAAQ;IAC5B,OAAO,CAAC,OAAO,CAAoC;gBAEvC,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM;IAK9D;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAYhE;;OAEG;IACG,SAAS,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBvF;;OAEG;IACH,eAAe,IAAI,MAAM;IAIzB;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI;CAKvC;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,SAAS,CAAW;gBAEhB,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS;IAK9D;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACnC,aAAa,EAAE,aAAa,CAAA;QAC5B,YAAY,EAAE,aAAa,CAAA;KAC5B,CAAC;IAiBF;;OAEG;IACG,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAYzF,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,mBAAmB;CAS5B;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAYvC;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAavC;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAQ3C;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAOnC;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,MAAU,GAAG,MAAM;CAW9D;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM;IAO5C;;OAEG;IACH,MAAM,CAAC,YAAY,IAAI,MAAM;IAS7B;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,GAAE,MAAa,GAAG,MAAM;IAKpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,IAAI,MAAM;CAGnC"}