@salamandradevs/core 0.1.4 → 0.2.0

package/README.md

@@ -22,8 +22,10 @@ details remain inside adapters.
 
 `src/database` contains the persistence contracts, dataset provisioner, and concrete MongoDB
 and MySQL adapters. `src/records` contains the base record model and handler used by services
-to build tenant-aware record policies. `src/utils` contains the execution-context helpers that
-bind service work to the current request or job.
+to build tenant-aware record policies. `src/runtime` holds the runtime execution context that
+binds service work to the current request or job. `src/keys` holds the key contracts, the
+Jose, OpenBao, and JWKS providers, and their factory. `src/tokens` holds the access-token
+verifier and claims schema.
 
 Services such as `@salamandradevs/auth` use Core to keep persistence details out of transport and
 application code while still enforcing tenant boundaries close to the record layer.

package/dist/index.js

@@ -1,4 +1,6 @@
 export * from './storage/index.js';
 export * from './infra/database/index.js';
-export * from './utils/index.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsa0JBQWtCLENBQUMifQ==
+export * from './keys/index.js';
+export * from './tokens/index.js';
+export * from './runtime/index.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLG9CQUFvQixDQUFDIn0=

package/dist/keys/config/index.js

@@ -0,0 +1,3 @@
+export * from './schema.js';
+export * from './types.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMva2V5cy9jb25maWcvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUMifQ==

package/dist/keys/config/schema.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { openBaoSigningKeysConfigSchema } from '../openbao/schema.js';
+import { joseSigningKeysConfigSchema } from '../jose/schema.js';
+/**
+ * Supported signing-key provider identifiers; grows as new providers are added.
+ *
+ * @group Keys
+ * @category Key Providers
+ */
+export const signingKeyProviderSchema = z.enum(['jose', 'openbao']);
+/**
+ * Signing-key provider selector resolved from the environment.
+ *
+ * - Provider: Active signing-key provider; read from `SIGNING_KEY_PROVIDER`.
+ *
+ * @remarks
+ * `provider` is marked `.meta({ env })`, so `loadEnvVariables` resolves it from
+ * `SIGNING_KEY_PROVIDER`; the active provider is chosen at runtime, never baked into the
+ * configuration file.
+ * @group Keys
+ * @category Key Providers
+ */
+export const signingKeyProviderSelectorSchema = z
+    .object({
+    provider: signingKeyProviderSchema.meta({ env: 'SIGNING_KEY_PROVIDER' })
+})
+    .strict();
+/**
+ * Provider-neutral signing lifecycle schema.
+ *
+ * - Algorithm: JOSE algorithm supported by this key set.
+ * - Jose: Jose provider configuration, present when the deployment may select `jose`.
+ * - Openbao: OpenBao provider configuration, present when the deployment may select
+ *   `openbao`.
+ *
+ * @remarks
+ * Each provider block is optional so a deployment configures only the providers it uses;
+ * the active one is chosen at runtime by `SIGNING_KEY_PROVIDER` and must have its block
+ * present. Composed into each service's own `serviceConfigSchema` and validated there; core
+ * never reads a configuration file.
+ * @group Keys
+ * @category Key Providers
+ */
+export const signingKeysConfigSchema = z
+    .object({
+    algorithm: z.literal('ES256'),
+    jose: joseSigningKeysConfigSchema.optional(),
+    openbao: openBaoSigningKeysConfigSchema.optional()
+})
+    .strict();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2tleXMvY29uZmlnL3NjaGVtYS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsQ0FBQyxFQUFFLE1BQU0sS0FBSyxDQUFDO0FBRXhCLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQ3RFLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRWhFOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0FBRXBFOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FBQztLQUM5QyxNQUFNLENBQUM7SUFDTixRQUFRLEVBQUUsd0JBQXdCLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLHNCQUFzQixFQUFFLENBQUM7Q0FDekUsQ0FBQztLQUNELE1BQU0sRUFBRSxDQUFDO0FBRVo7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQztLQUNyQyxNQUFNLENBQUM7SUFDTixTQUFTLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7SUFDN0IsSUFBSSxFQUFFLDJCQUEyQixDQUFDLFFBQVEsRUFBRTtJQUM1QyxPQUFPLEVBQUUsOEJBQThCLENBQUMsUUFBUSxFQUFFO0NBQ25ELENBQUM7S0FDRCxNQUFNLEVBQUUsQ0FBQyJ9

package/dist/keys/config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMva2V5cy9jb25maWcvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/keys/contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udHJhY3RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2tleXMvY29udHJhY3RzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist/keys/factory.js

@@ -0,0 +1,61 @@
+import { CustomError } from '@salamandradevs/tools/shared';
+import { loadEnvVariables } from '@salamandradevs/tools/node';
+import { OpenBaoKeysProvider } from './openbao/index.js';
+import { JoseKeysProvider } from './jose/index.js';
+import { signingKeyProviderSchema } from './config/schema.js';
+import { signingKeyProviderSelectorSchema } from './config/schema.js';
+/**
+ * Selects and constructs the keys provider named by `SIGNING_KEY_PROVIDER`.
+ *
+ * @remarks
+ * Construction only: each provider resolves its own environment as it is constructed but
+ * performs no input or output, so all network and file work is deferred to `initialize()`.
+ * The `switch` is the single extension point; a new provider is a new enum member, a new
+ * `case`, and its own configuration block, with no change to the bootstrap step or the
+ * services that consume the provider. Returns the owner of the key set as
+ * {@link IKeysProvider}; the composition root hands each consumer only the role it uses.
+ * @group Keys
+ * @category Key Providers
+ * @param config - Signing lifecycle and per-provider configuration.
+ * @returns The keys provider named by `SIGNING_KEY_PROVIDER`, ready for `initialize()`.
+ * @throws {CustomError} ENV_VAR_ERROR when `SIGNING_KEY_PROVIDER` is missing or not a
+ *   recognized provider, or (for OpenBao) when the provider's own variables are missing.
+ * @throws {CustomError} CONFIG_ERROR when the selected provider has no configuration block.
+ */
+export function createKeysProvider(config) {
+    const selector = loadEnvVariables(signingKeyProviderSelectorSchema);
+    // loadEnvVariables validates the value but widens it to `string`; re-read it through the
+    // enum to recover the literal type the exhaustive `switch` below relies on.
+    const provider = signingKeyProviderSchema.parse(selector.provider);
+    switch (provider) {
+        case 'openbao': {
+            if (!config.openbao) {
+                throw new CustomError({
+                    name: 'CONFIG_ERROR',
+                    message: 'SIGNING_KEY_PROVIDER is openbao but signingKeys.openbao is not configured'
+                });
+            }
+            // The provider reads its own environment from the variables its config names, so this
+            // factory composes it from configuration alone and never handles the origin or token.
+            return new OpenBaoKeysProvider(config.openbao, config.algorithm, config.openbao.refreshCooldownSecs);
+        }
+        case 'jose': {
+            if (!config.jose) {
+                throw new CustomError({
+                    name: 'CONFIG_ERROR',
+                    message: 'SIGNING_KEY_PROVIDER is jose but signingKeys.jose is not configured'
+                });
+            }
+            return new JoseKeysProvider(config.jose, config.algorithm);
+        }
+        default: {
+            // Exhaustiveness: adding a provider to the enum without a case here fails to compile.
+            const unknownProvider = provider;
+            throw new CustomError({
+                name: 'CONFIG_ERROR',
+                message: `Unhandled signing-key provider: ${String(unknownProvider)}`
+            });
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZmFjdG9yeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rZXlzL2ZhY3RvcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzNELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBRTlELE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ3pELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQ25ELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzlELE9BQU8sRUFBRSxnQ0FBZ0MsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBS3RFOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxNQUF5QjtJQUMxRCxNQUFNLFFBQVEsR0FBMkIsZ0JBQWdCLENBQ3ZELGdDQUFnQyxDQUNqQyxDQUFDO0lBRUYseUZBQXlGO0lBQ3pGLDRFQUE0RTtJQUM1RSxNQUFNLFFBQVEsR0FBdUIsd0JBQXdCLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUV2RixRQUFRLFFBQVEsRUFBRSxDQUFDO1FBQ2pCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQztZQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3BCLE1BQU0sSUFBSSxXQUFXLENBQUM7b0JBQ3BCLElBQUksRUFBRSxjQUFjO29CQUNwQixPQUFPLEVBQ0wsMkVBQTJFO2lCQUM5RSxDQUFDLENBQUM7WUFDTCxDQUFDO1lBRUQsc0ZBQXNGO1lBQ3RGLHNGQUFzRjtZQUN0RixPQUFPLElBQUksbUJBQW1CLENBQzVCLE1BQU0sQ0FBQyxPQUFPLEVBQ2QsTUFBTSxDQUFDLFNBQVMsRUFDaEIsTUFBTSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FDbkMsQ0FBQztRQUNKLENBQUM7UUFFRCxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUM7WUFDWixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNqQixNQUFNLElBQUksV0FBVyxDQUFDO29CQUNwQixJQUFJLEVBQUUsY0FBYztvQkFDcEIsT0FBTyxFQUFFLHFFQUFxRTtpQkFDL0UsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUVELE9BQU8sSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBRUQsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUNSLHNGQUFzRjtZQUN0RixNQUFNLGVBQWUsR0FBVSxRQUFRLENBQUM7WUFFeEMsTUFBTSxJQUFJLFdBQVcsQ0FBQztnQkFDcEIsSUFBSSxFQUFFLGNBQWM7Z0JBQ3BCLE9BQU8sRUFBRSxtQ0FBbUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxFQUFFO2FBQ3RFLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist/keys/index.js

@@ -0,0 +1,10 @@
+export * from './config/index.js';
+export * from './contracts.js';
+export * from './factory.js';
+export * from './jose/index.js';
+export * from './jwks/index.js';
+export * from './openbao/index.js';
+export * from './schema.js';
+export * from './types.js';
+export * from './validation.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva2V5cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxpQkFBaUIsQ0FBQyJ9

package/dist/keys/jose/index.js

@@ -0,0 +1,3 @@
+export * from './jose-keys-provider.js';
+export * from './schema.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMva2V5cy9qb3NlL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxhQUFhLENBQUMifQ==

package/dist/keys/jose/jose-keyfile.js

@@ -0,0 +1,97 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { CompactEncrypt, compactDecrypt } from 'jose';
+import { CustomError } from '@salamandradevs/tools/shared';
+import { keyFilePayloadSchema } from './schema.js';
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** JWE key-management and content-encryption algorithms used for the key file. */
+const KEY_MANAGEMENT_ALG = 'PBES2-HS256+A128KW';
+const CONTENT_ENCRYPTION_ALG = 'A256GCM';
+/**
+ * Reads and decrypts the encrypted key file, or reports its absence.
+ *
+ * @remarks
+ * A decrypt or parse failure is reported, never swallowed: a wrong passphrase must fail
+ * loudly rather than be mistaken for an absent file, so a typo cannot discard the keys.
+ * @group Keys
+ * @category Key Providers
+ * @param filePath - Path to the encrypted key file.
+ * @param secret - Passphrase that decrypts the compact JWE.
+ * @returns Validated key-file payload, or null when no file exists.
+ * @throws {CustomError} KEYS_PROVIDER_ERROR when the file exists but cannot be read,
+ *   decrypted, or parsed into a valid key-file payload.
+ */
+export async function readKeyFile(filePath, secret) {
+    let jwe;
+    try {
+        jwe = await readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return null;
+        }
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: `Signing-key file at '${filePath}' could not be read`,
+            cause: error
+        });
+    }
+    try {
+        // `jose` requires PBES2 key management to be opted into on decrypt (an attacker-chosen
+        // iteration count is a DoS vector), so allow exactly the algorithms this module writes and
+        // reject anything else.
+        const { plaintext } = await compactDecrypt(jwe, encoder.encode(secret), {
+            keyManagementAlgorithms: [KEY_MANAGEMENT_ALG],
+            contentEncryptionAlgorithms: [CONTENT_ENCRYPTION_ALG]
+        });
+        const payload = JSON.parse(decoder.decode(plaintext));
+        return keyFilePayloadSchema.parse(payload);
+    }
+    catch (error) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: `Signing-key file at '${filePath}' could not be decrypted or is invalid; ` +
+                `the passphrase may be wrong`,
+            cause: error
+        });
+    }
+}
+/**
+ * Encrypts and writes the key file, creating it only when none already exists.
+ *
+ * @remarks
+ * The `wx` flag makes the create exclusive and `0o600` restricts it to the owner, so two
+ * processes racing on one host resolve to one winner; the loser sees the file already
+ * exists, is told so by the false return, and reads the winner's key instead of minting a
+ * second.
+ * @group Keys
+ * @category Key Providers
+ * @param filePath - Path to the encrypted key file.
+ * @param secret - Passphrase that encrypts the compact JWE.
+ * @param payload - Key-file payload to persist.
+ * @returns True when this call created the file, false when one already existed.
+ * @throws {CustomError} KEYS_PROVIDER_ERROR when encryption or the write fails for any
+ *   reason other than the file already existing.
+ */
+export async function writeKeyFile(filePath, secret, payload) {
+    try {
+        const jwe = await new CompactEncrypt(encoder.encode(JSON.stringify(payload)))
+            .setProtectedHeader({ alg: KEY_MANAGEMENT_ALG, enc: CONTENT_ENCRYPTION_ALG })
+            .encrypt(encoder.encode(secret));
+        await mkdir(dirname(filePath), { recursive: true });
+        await writeFile(filePath, jwe, { mode: 0o600, flag: 'wx' });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'EEXIST') {
+            return false;
+        }
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: `Signing-key file at '${filePath}' could not be written`,
+            cause: error
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS1rZXlmaWxlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2tleXMvam9zZS9qb3NlLWtleWZpbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDOUQsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUVwQyxPQUFPLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxNQUFNLE1BQU0sQ0FBQztBQUN0RCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFM0QsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBR25ELE1BQU0sT0FBTyxHQUFnQixJQUFJLFdBQVcsRUFBRSxDQUFDO0FBQy9DLE1BQU0sT0FBTyxHQUFnQixJQUFJLFdBQVcsRUFBRSxDQUFDO0FBRS9DLGtGQUFrRjtBQUNsRixNQUFNLGtCQUFrQixHQUFXLG9CQUFvQixDQUFDO0FBQ3hELE1BQU0sc0JBQXNCLEdBQVcsU0FBUyxDQUFDO0FBRWpEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FDL0IsUUFBZ0IsRUFDaEIsTUFBYztJQUVkLElBQUksR0FBVyxDQUFDO0lBRWhCLElBQUksQ0FBQztRQUNILEdBQUcsR0FBRyxNQUFNLFFBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUFDLE9BQU8sS0FBYyxFQUFFLENBQUM7UUFDeEIsSUFBSSxLQUFLLFlBQVksS0FBSyxJQUFJLE1BQU0sSUFBSSxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN6RSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCxNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxxQkFBcUI7WUFDM0IsT0FBTyxFQUFFLHdCQUF3QixRQUFRLHFCQUFxQjtZQUM5RCxLQUFLLEVBQUUsS0FBSztTQUNiLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxJQUFJLENBQUM7UUFDSCx1RkFBdUY7UUFDdkYsMkZBQTJGO1FBQzNGLHdCQUF3QjtRQUN4QixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxjQUFjLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDdEUsdUJBQXVCLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQztZQUM3QywyQkFBMkIsRUFBRSxDQUFDLHNCQUFzQixDQUFDO1NBQ3RELENBQUMsQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFZLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBRS9ELE9BQU8sb0JBQW9CLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxXQUFXLENBQUM7WUFDcEIsSUFBSSxFQUFFLHFCQUFxQjtZQUMzQixPQUFPLEVBQ0wsd0JBQXdCLFFBQVEsMENBQTBDO2dCQUMxRSw2QkFBNkI7WUFDL0IsS0FBSyxFQUFFLEtBQUs7U0FDYixDQUFDLENBQUM7SUFDTCxDQUFDO0FBQ0gsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxZQUFZLENBQ2hDLFFBQWdCLEVBQ2hCLE1BQWMsRUFDZCxPQUF1QjtJQUV2QixJQUFJLENBQUM7UUFDSCxNQUFNLEdBQUcsR0FBVyxNQUFNLElBQUksY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO2FBQ2xGLGtCQUFrQixDQUFDLEVBQUUsR0FBRyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsRUFBRSxzQkFBc0IsRUFBRSxDQUFDO2FBQzVFLE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFFbkMsTUFBTSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDcEQsTUFBTSxTQUFTLENBQUMsUUFBUSxFQUFFLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFFNUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztRQUN4QixJQUFJLEtBQUssWUFBWSxLQUFLLElBQUksTUFBTSxJQUFJLEtBQUssSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3pFLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELE1BQU0sSUFBSSxXQUFXLENBQUM7WUFDcEIsSUFBSSxFQUFFLHFCQUFxQjtZQUMzQixPQUFPLEVBQUUsd0JBQXdCLFFBQVEsd0JBQXdCO1lBQ2pFLEtBQUssRUFBRSxLQUFLO1NBQ2IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUMifQ==

package/dist/keys/jose/jose-keys-provider.js

@@ -0,0 +1,256 @@
+import { randomUUID } from 'node:crypto';
+import { exportJWK, generateKeyPair, importJWK } from 'jose';
+import { CustomError } from '@salamandradevs/tools/shared';
+import { loadEnvVariables } from '@salamandradevs/tools/node';
+import { readKeyFile, writeKeyFile } from './jose-keyfile.js';
+import { joseStorageConfigSchema } from './schema.js';
+import { validateSigningKeyState } from '../validation.js';
+/**
+ * Node.js-native keys provider that keeps its key set in an encrypted local file.
+ *
+ * @remarks
+ * Generates its own ES256 key on first run and keeps the private material in an encrypted
+ * file keyed from the environment, then signs and verifies against that one key set. It
+ * fits a small deployment: a single host, or replicas sharing one key file, with the file
+ * on a persistent volume and the file and `JOSE_KEYFILE_PASSPHRASE` backed up separately.
+ * Compared with {@link OpenBaoKeysProvider}, it accepts that the private key lives in
+ * process memory, that replacing the key file reissues every credential it signed, and that
+ * no policy layer limits key use; OpenBao is the choice when those costs are not
+ * acceptable. It serves one active key and never rotates.
+ * @group Keys
+ * @category Key Providers
+ */
+export class JoseKeysProvider {
+    config;
+    algorithm;
+    /** Built once in initialize(); no rotation means no refresh machinery. */
+    snapshot = null;
+    /**
+     * @param config - Validated Jose provider configuration.
+     * @param algorithm - JOSE algorithm enforced for the generated key.
+     */
+    constructor(config, algorithm) {
+        this.config = config;
+        this.algorithm = algorithm;
+    }
+    /**
+     * Loads the encrypted key file and publishes the first snapshot, generating a key on
+     * first run when the file is absent.
+     *
+     * @remarks
+     * Hard reset: delete the key file and restart. An absent file re-enters the
+     * generate-on-empty path and mints a fresh key, so there is no separate reset operation.
+     * The file is read once here, so deleting it while the process runs takes effect only on
+     * the next initialize(); the running provider keeps serving the key already in memory.
+     * This is a hard reset, not a rotation: the previous kid leaves the published key set at
+     * once and every credential it signed stops verifying. A decrypt failure fails loudly and
+     * is never treated as an empty file, so a wrong passphrase cannot discard the keys.
+     * @group Keys
+     * @category Key Providers
+     * @returns Completed provider initialization.
+     * @throws {CustomError} ENV_VAR_ERROR when the passphrase env variable is unset or blank.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when the file cannot be decrypted or violates
+     *   a signing-key invariant.
+     */
+    async initialize() {
+        // The passphrase is sensitive, so it is read and validated from the environment; the config
+        // holds only a placeholder.
+        const secret = loadEnvVariables(joseStorageConfigSchema).passphrase;
+        const existing = await readKeyFile(this.config.storage.filePath, secret);
+        const payload = existing ?? (await this.createKeyFile(secret));
+        await this.publishSnapshot(payload);
+    }
+    /**
+     * Returns a signer bound to the active key.
+     *
+     * @group Keys
+     * @category Key Providers
+     * @returns Provider-neutral signing capability.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when initialize() has not completed.
+     */
+    getCurrentSigner() {
+        const { activeSigner } = this.currentSnapshot();
+        return Promise.resolve({
+            kid: activeSigner.kid,
+            algorithm: this.algorithm,
+            // Web Crypto ECDSA P-256 with SHA-256 returns the raw 64-byte r||s pair, identical to
+            // the OpenBao Transit path and to what the JWS signing input expects.
+            sign: async (input) => {
+                // Copy into a fresh ArrayBuffer-backed view so the Web Crypto BufferSource type is
+                // satisfied whatever buffer backs the caller's input.
+                const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, activeSigner.privateKey, new Uint8Array(input));
+                return new Uint8Array(signature);
+            }
+        });
+    }
+    /**
+     * Resolves one eligible public key by exact key identifier.
+     *
+     * @group Keys
+     * @category Key Providers
+     * @param kid - Key identifier carried with the signature.
+     * @returns Public verification key, or null for an unknown key.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when initialize() has not completed.
+     */
+    getPublicKey(kid) {
+        return Promise.resolve(this.currentSnapshot().byKid.get(kid) ?? null);
+    }
+    /**
+     * Lists the public keys eligible for JWKS publication.
+     *
+     * @group Keys
+     * @category Key Providers
+     * @returns Retained public JSON Web Keys.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when initialize() has not completed.
+     */
+    listPublicKeys() {
+        return Promise.resolve(this.currentSnapshot().keys);
+    }
+    /**
+     * Generates the first key and writes it, adopting an existing file when a concurrent
+     * start won the race.
+     *
+     * @param secret - Passphrase that encrypts the key file.
+     * @returns The persisted key-file payload.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when the file cannot be written or re-read.
+     */
+    async createKeyFile(secret) {
+        const payload = await this.generatePayload();
+        const created = await writeKeyFile(this.config.storage.filePath, secret, payload);
+        if (created) {
+            return payload;
+        }
+        // Another process created the file first; adopt its key rather than minting a second.
+        const existing = await readKeyFile(this.config.storage.filePath, secret);
+        if (!existing) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: `Signing-key file at '${this.config.storage.filePath}' vanished after creation`
+            });
+        }
+        return existing;
+    }
+    /**
+     * Generates one active ES256 key and the key-file payload that persists it.
+     *
+     * @returns Key-file payload with a single active key and its private material.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when the generated key is missing JWK
+     *   coordinates.
+     */
+    async generatePayload() {
+        const { publicKey, privateKey } = await generateKeyPair(this.algorithm, {
+            extractable: true
+        });
+        const publicJwkRaw = await exportJWK(publicKey);
+        const privateJwkRaw = await exportJWK(privateKey);
+        if (!publicJwkRaw.x || !publicJwkRaw.y || !privateJwkRaw.d) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Generated EC key is missing required JWK coordinates'
+            });
+        }
+        const kid = `${this.config.keyNamePrefix}-${randomUUID()}`;
+        const now = new Date().toISOString();
+        const publicJwk = {
+            kty: 'EC',
+            kid,
+            use: 'sig',
+            alg: this.algorithm,
+            crv: 'P-256',
+            x: publicJwkRaw.x,
+            y: publicJwkRaw.y
+        };
+        const privateJwk = {
+            kty: 'EC',
+            crv: 'P-256',
+            x: publicJwkRaw.x,
+            y: publicJwkRaw.y,
+            d: privateJwkRaw.d
+        };
+        // Build against KeyFilePayload directly: the lifecycle types are read-only projections,
+        // while the persisted shape is the mutable schema-inferred one.
+        return {
+            state: {
+                currentKid: kid,
+                keys: [
+                    {
+                        kid,
+                        providerKeyId: kid,
+                        status: 'active',
+                        publicJwk,
+                        activateAfter: now,
+                        activatedAt: now,
+                        retiredAt: null,
+                        verifyUntil: null
+                    }
+                ]
+            },
+            privateJwks: { [kid]: privateJwk }
+        };
+    }
+    /**
+     * Validates the payload and publishes the in-process snapshot.
+     *
+     * @param payload - Key-file payload to project.
+     * @returns Completed snapshot publication.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when the state is invalid or a JWK cannot be
+     *   imported as an asymmetric key.
+     */
+    async publishSnapshot(payload) {
+        const state = validateSigningKeyState(payload.state, this.algorithm);
+        const keys = [];
+        const byKid = new Map();
+        for (const entry of state.keys) {
+            const imported = await importJWK(entry.publicJwk, this.algorithm);
+            // `importJWK` returns bytes for symmetric keys; a published JWK must be asymmetric.
+            if (imported instanceof Uint8Array) {
+                throw new CustomError({
+                    name: 'KEYS_PROVIDER_ERROR',
+                    message: 'Signing-key state contains a non-public JWK'
+                });
+            }
+            keys.push(entry.publicJwk);
+            byKid.set(entry.kid, imported);
+        }
+        const activeKid = state.currentKid;
+        if (activeKid === null || !(activeKid in payload.privateJwks)) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key file has no private key for the active key'
+            });
+        }
+        const privateJwk = payload.privateJwks[activeKid];
+        const privateKey = await importJWK(privateJwk, this.algorithm);
+        if (privateKey instanceof Uint8Array) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key file contains a non-EC private JWK'
+            });
+        }
+        // Single assignment, so readers move from no snapshot to one complete snapshot.
+        this.snapshot = {
+            state,
+            keys,
+            byKid,
+            activeSigner: { kid: activeKid, privateKey }
+        };
+    }
+    /**
+     * Returns the snapshot published by initialize().
+     *
+     * @returns The in-process projection of the signing-key state.
+     * @throws {CustomError} KEYS_PROVIDER_ERROR when initialize() has not completed.
+     */
+    currentSnapshot() {
+        // Built once in initialize() and never refreshed, so a missing snapshot means the provider
+        // was used before initialize() completed.
+        if (!this.snapshot) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key snapshot is unavailable; initialize() has not completed'
+            });
+        }
+        return this.snapshot;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS1rZXlzLXByb3ZpZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2tleXMvam9zZS9qb3NlLWtleXMtcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUV6QyxPQUFPLEVBQUUsU0FBUyxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQUUsTUFBTSxNQUFNLENBQUM7QUFDN0QsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzNELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBRzlELE9BQU8sRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDOUQsT0FBTyxFQUFFLHVCQUF1QixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQ3RELE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBUTNEOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBQ0gsTUFBTSxPQUFPLGdCQUFnQjtJQVNSO0lBQ0E7SUFUbkIsMEVBQTBFO0lBQ2xFLFFBQVEsR0FBOEIsSUFBSSxDQUFDO0lBRW5EOzs7T0FHRztJQUNILFlBQ21CLE1BQTZCLEVBQzdCLFNBQWtCO1FBRGxCLFdBQU0sR0FBTixNQUFNLENBQXVCO1FBQzdCLGNBQVMsR0FBVCxTQUFTLENBQVM7SUFDbEMsQ0FBQztJQUVKOzs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FrQkc7SUFDSCxLQUFLLENBQUMsVUFBVTtRQUNkLDRGQUE0RjtRQUM1Riw0QkFBNEI7UUFDNUIsTUFBTSxNQUFNLEdBQVcsZ0JBQWdCLENBQUMsdUJBQXVCLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFFNUUsTUFBTSxRQUFRLEdBQTBCLE1BQU0sV0FBVyxDQUN2RCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQzVCLE1BQU0sQ0FDUCxDQUFDO1FBQ0YsTUFBTSxPQUFPLEdBQW1CLFFBQVEsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBRS9FLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNILGdCQUFnQjtRQUNkLE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7UUFFaEQsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDO1lBQ3JCLEdBQUcsRUFBRSxZQUFZLENBQUMsR0FBRztZQUNyQixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7WUFDekIsc0ZBQXNGO1lBQ3RGLHNFQUFzRTtZQUN0RSxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQWlCLEVBQXVCLEVBQUU7Z0JBQ3JELG1GQUFtRjtnQkFDbkYsc0RBQXNEO2dCQUN0RCxNQUFNLFNBQVMsR0FBZ0IsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FDckQsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFDbEMsWUFBWSxDQUFDLFVBQVUsRUFDdkIsSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQ3RCLENBQUM7Z0JBRUYsT0FBTyxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuQyxDQUFDO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7Ozs7OztPQVFHO0lBQ0gsWUFBWSxDQUFDLEdBQVc7UUFDdEIsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0gsY0FBYztRQUNaLE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdEQsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSyxLQUFLLENBQUMsYUFBYSxDQUFDLE1BQWM7UUFDeEMsTUFBTSxPQUFPLEdBQW1CLE1BQU0sSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQzdELE1BQU0sT0FBTyxHQUFZLE1BQU0sWUFBWSxDQUN6QyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQzVCLE1BQU0sRUFDTixPQUFPLENBQ1IsQ0FBQztRQUVGLElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixPQUFPLE9BQU8sQ0FBQztRQUNqQixDQUFDO1FBRUQsc0ZBQXNGO1FBQ3RGLE1BQU0sUUFBUSxHQUEwQixNQUFNLFdBQVcsQ0FDdkQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUM1QixNQUFNLENBQ1AsQ0FBQztRQUVGLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQ3BCLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLE9BQU8sRUFBRSx3QkFBd0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSwyQkFBMkI7YUFDekYsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSyxLQUFLLENBQUMsZUFBZTtRQUMzQixNQUFNLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxHQUFHLE1BQU0sZUFBZSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUU7WUFDdEUsV0FBVyxFQUFFLElBQUk7U0FDbEIsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxZQUFZLEdBQVEsTUFBTSxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDckQsTUFBTSxhQUFhLEdBQVEsTUFBTSxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7UUFFdkQsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzNELE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQ3BCLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLE9BQU8sRUFBRSxzREFBc0Q7YUFDaEUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUFXLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLElBQUksVUFBVSxFQUFFLEVBQUUsQ0FBQztRQUNuRSxNQUFNLEdBQUcsR0FBVyxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzdDLE1BQU0sU0FBUyxHQUFjO1lBQzNCLEdBQUcsRUFBRSxJQUFJO1lBQ1QsR0FBRztZQUNILEdBQUcsRUFBRSxLQUFLO1lBQ1YsR0FBRyxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ25CLEdBQUcsRUFBRSxPQUFPO1lBQ1osQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQ2pCLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztTQUNsQixDQUFDO1FBQ0YsTUFBTSxVQUFVLEdBQWU7WUFDN0IsR0FBRyxFQUFFLElBQUk7WUFDVCxHQUFHLEVBQUUsT0FBTztZQUNaLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztZQUNqQixDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDakIsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1NBQ25CLENBQUM7UUFFRix3RkFBd0Y7UUFDeEYsZ0VBQWdFO1FBQ2hFLE9BQU87WUFDTCxLQUFLLEVBQUU7Z0JBQ0wsVUFBVSxFQUFFLEdBQUc7Z0JBQ2YsSUFBSSxFQUFFO29CQUNKO3dCQUNFLEdBQUc7d0JBQ0gsYUFBYSxFQUFFLEdBQUc7d0JBQ2xCLE1BQU0sRUFBRSxRQUFRO3dCQUNoQixTQUFTO3dCQUNULGFBQWEsRUFBRSxHQUFHO3dCQUNsQixXQUFXLEVBQUUsR0FBRzt3QkFDaEIsU0FBUyxFQUFFLElBQUk7d0JBQ2YsV0FBVyxFQUFFLElBQUk7cUJBQ2xCO2lCQUNGO2FBQ0Y7WUFDRCxXQUFXLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLFVBQVUsRUFBRTtTQUNuQyxDQUFDO0lBQ0osQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSyxLQUFLLENBQUMsZUFBZSxDQUFDLE9BQXVCO1FBQ25ELE1BQU0sS0FBSyxHQUFvQix1QkFBdUIsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN0RixNQUFNLElBQUksR0FBZ0IsRUFBRSxDQUFDO1FBQzdCLE1BQU0sS0FBSyxHQUEyQixJQUFJLEdBQUcsRUFBcUIsQ0FBQztRQUVuRSxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUMvQixNQUFNLFFBQVEsR0FBMkIsTUFBTSxTQUFTLENBQ3RELEtBQUssQ0FBQyxTQUFTLEVBQ2YsSUFBSSxDQUFDLFNBQVMsQ0FDZixDQUFDO1lBRUYsb0ZBQW9GO1lBQ3BGLElBQUksUUFBUSxZQUFZLFVBQVUsRUFBRSxDQUFDO2dCQUNuQyxNQUFNLElBQUksV0FBVyxDQUFDO29CQUNwQixJQUFJLEVBQUUscUJBQXFCO29CQUMzQixPQUFPLEVBQUUsNkNBQTZDO2lCQUN2RCxDQUFDLENBQUM7WUFDTCxDQUFDO1lBRUQsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDM0IsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2pDLENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBa0IsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUVsRCxJQUFJLFNBQVMsS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFNBQVMsSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUM5RCxNQUFNLElBQUksV0FBVyxDQUFDO2dCQUNwQixJQUFJLEVBQUUscUJBQXFCO2dCQUMzQixPQUFPLEVBQUUsd0RBQXdEO2FBQ2xFLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBZSxPQUFPLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlELE1BQU0sVUFBVSxHQUEyQixNQUFNLFNBQVMsQ0FDeEQsVUFBVSxFQUNWLElBQUksQ0FBQyxTQUFTLENBQ2YsQ0FBQztRQUVGLElBQUksVUFBVSxZQUFZLFVBQVUsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQ3BCLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLE9BQU8sRUFBRSxnREFBZ0Q7YUFDMUQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELGdGQUFnRjtRQUNoRixJQUFJLENBQUMsUUFBUSxHQUFHO1lBQ2QsS0FBSztZQUNMLElBQUk7WUFDSixLQUFLO1lBQ0wsWUFBWSxFQUFFLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUU7U0FDN0MsQ0FBQztJQUNKLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNLLGVBQWU7UUFDckIsMkZBQTJGO1FBQzNGLDBDQUEwQztRQUMxQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ25CLE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQ3BCLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLE9BQU8sRUFBRSxxRUFBcUU7YUFDL0UsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQztJQUN2QixDQUFDO0NBQ0YifQ==

package/dist/keys/jose/schema.js

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+import { signingKeyStateSchema } from '../schema.js';
+/**
+ * Jose key-file storage schema.
+ *
+ * - FilePath: Path to the encrypted key file; must be listed in `.gitignore`.
+ * - Passphrase: Encrypted key-file passphrase; a secret, read from `JOSE_KEYFILE_PASSPHRASE`.
+ *
+ * @remarks
+ * `passphrase` is marked `.meta({ env })`, so `loadEnvVariables` resolves it from
+ * `JOSE_KEYFILE_PASSPHRASE`; the configuration file holds only a placeholder.
+ */
+export const joseStorageConfigSchema = z
+    .object({
+    filePath: z.string().min(1),
+    passphrase: z
+        .string({ error: 'is required' })
+        .min(1, 'must not be empty')
+        .meta({ env: 'JOSE_KEYFILE_PASSPHRASE' })
+})
+    .strict();
+/**
+ * Jose provider configuration and local-storage schema.
+ *
+ * - KeyNamePrefix: Prefix for the generated `kid` and provider key identifier.
+ * - Storage: Encrypted key-file location and passphrase source.
+ *
+ * @remarks
+ * Self-contained so the provider directory owns its whole storage story without the factory
+ * ever handling a file path or a secret.
+ */
+export const joseSigningKeysConfigSchema = z
+    .object({
+    keyNamePrefix: z.string().min(1),
+    storage: joseStorageConfigSchema
+})
+    .strict();
+/**
+ * EC P-256 private JWK persisted in the encrypted key file.
+ *
+ * - Kty: Key type, always `EC`.
+ * - Crv: Curve, always `P-256`.
+ * - X: Public x coordinate.
+ * - Y: Public y coordinate.
+ * - D: Private scalar; the secret half, which is why the file is encrypted at rest.
+ */
+export const privateJwkSchema = z
+    .object({
+    kty: z.literal('EC'),
+    crv: z.literal('P-256'),
+    x: z.string().min(1),
+    y: z.string().min(1),
+    d: z.string().min(1)
+})
+    .strict();
+/**
+ * Decrypted key-file payload.
+ *
+ * - State: Signing-key lifecycle document shared with every provider.
+ * - PrivateJwks: Private signing material indexed by `kid`.
+ */
+export const keyFilePayloadSchema = z
+    .object({
+    state: signingKeyStateSchema,
+    privateJwks: z.record(z.string().min(1), privateJwkSchema)
+})
+    .strict();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2tleXMvam9zZS9zY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4QixPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFckQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQztLQUNyQyxNQUFNLENBQUM7SUFDTixRQUFRLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDM0IsVUFBVSxFQUFFLENBQUM7U0FDVixNQUFNLENBQUMsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7U0FDaEMsR0FBRyxDQUFDLENBQUMsRUFBRSxtQkFBbUIsQ0FBQztTQUMzQixJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUseUJBQXlCLEVBQUUsQ0FBQztDQUM1QyxDQUFDO0tBQ0QsTUFBTSxFQUFFLENBQUM7QUFFWjs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDO0tBQ3pDLE1BQU0sQ0FBQztJQUNOLGFBQWEsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNoQyxPQUFPLEVBQUUsdUJBQXVCO0NBQ2pDLENBQUM7S0FDRCxNQUFNLEVBQUUsQ0FBQztBQUVaOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQztLQUM5QixNQUFNLENBQUM7SUFDTixHQUFHLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7SUFDcEIsR0FBRyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO0lBQ3ZCLENBQUMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNwQixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDcEIsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0NBQ3JCLENBQUM7S0FDRCxNQUFNLEVBQUUsQ0FBQztBQUVaOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQztLQUNsQyxNQUFNLENBQUM7SUFDTixLQUFLLEVBQUUscUJBQXFCO0lBQzVCLFdBQVcsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsZ0JBQWdCLENBQUM7Q0FDM0QsQ0FBQztLQUNELE1BQU0sRUFBRSxDQUFDIn0=

package/dist/keys/jose/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMva2V5cy9qb3NlL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist/keys/jwks/index.js

@@ -0,0 +1,2 @@
+export * from './jwks-verification-key-provider.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMva2V5cy9qd2tzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMscUNBQXFDLENBQUMifQ==