@sebastienrousseau/crypto-server 0.0.2 → 0.0.8

package/dist/config/constants.d.ts

@@ -0,0 +1,54 @@
+import { FastifyServerOptions } from "fastify";
+import { FastifyCompressOptions } from "@fastify/compress";
+import type { FastifyCorsOptions } from "@fastify/cors";
+import type { FastifyHelmetOptions } from "@fastify/helmet";
+export declare const LIB_VERSION: string;
+export declare const HOST: string;
+export declare const PORT: string | number;
+export declare const PROTOCOL: string;
+export declare const consoleOutput: string[];
+export declare const fastifyOptions: FastifyServerOptions;
+export declare const compressOptions: FastifyCompressOptions;
+export declare const helmetOptions: FastifyHelmetOptions;
+export declare const corsOptions: FastifyCorsOptions;
+export declare const PROBE_PATHS: ReadonlySet<string>;
+export declare const isProbePath: (url: string) => boolean;
+export declare const rateLimitOptions: {
+    global: boolean;
+    max: number;
+    timeWindow: string;
+    allowList: (req: {
+        url: string;
+    }) => boolean;
+    nameSpace: string;
+    addHeaders: {
+        "x-ratelimit-limit": boolean;
+        "x-ratelimit-remaining": boolean;
+        "x-ratelimit-reset": boolean;
+        "retry-after": boolean;
+    };
+    errorResponseBuilder(req: {
+        ip: string;
+        log: {
+            warn: (msg: string) => void;
+        };
+    }, context: {
+        statusCode: number;
+        max: number;
+        after: string;
+        ttl: number;
+    }): {
+        statusCode: number;
+        code: number;
+        error: string;
+        message: string;
+        date: number;
+        expiresIn: number;
+    };
+};
+export declare const resolveRateLimitMax: () => number;
+export declare const healthCheckOptions: {
+    healthcheckUrl: string;
+    exposeUptime: boolean;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/config/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/config/constants.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAQ5D,eAAO,MAAM,WAAW,QAA+B,CAAC;AAMxD,eAAO,MAAM,IAAI,QAAqC,CAAC;AAMvD,eAAO,MAAM,IAAI,iBAA8B,CAAC;AAMhD,eAAO,MAAM,QAAQ,QAAoC,CAAC;AAsB1D,eAAO,MAAM,aAAa,UAMzB,CAAC;AAMF,eAAO,MAAM,cAAc,EAAE,oBAa5B,CAAC;AAOF,eAAO,MAAM,eAAe,EAAE,sBAM7B,CAAC;AAOF,eAAO,MAAM,aAAa,EAAE,oBAG3B,CAAC;AAOF,eAAO,MAAM,WAAW,EAAE,kBAOzB,CAAC;AAOF,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAK1C,CAAC;AAKH,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OACN,CAAC;AAMrC,eAAO,MAAM,gBAAgB;;;;qBAgBV;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO;;;;;;;;8BAiBnC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE;YAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;SAAE,CAAA;KAAE,WAChD;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;;;;;;;;CAoB3E,CAAC;AAOF,eAAO,MAAM,mBAAmB,QAAO,MAKtC,CAAC;AAMF,eAAO,MAAM,kBAAkB;;;CAK9B,CAAC"}

package/dist/config/constants.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.healthCheckOptions = exports.resolveRateLimitMax = exports.rateLimitOptions = exports.isProbePath = exports.PROBE_PATHS = exports.corsOptions = exports.helmetOptions = exports.compressOptions = exports.fastifyOptions = exports.consoleOutput = exports.PROTOCOL = exports.PORT = exports.HOST = exports.LIB_VERSION = void 0;
+const pack = require("../../package.json");
+exports.LIB_VERSION = JSON.stringify(pack.version);
+exports.HOST = process.env["HOST"] ?? "localhost";
+exports.PORT = process.env["PORT"] ?? 3000;
+exports.PROTOCOL = process.env["PROTOCOL"] ?? "http";
+const parseTrustProxy = () => {
+    const raw = process.env["TRUSTED_PROXY_CIDRS"];
+    if (!raw)
+        return false;
+    return raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+};
+exports.consoleOutput = [
+    `\n → protocol: ${exports.PROTOCOL}`,
+    `\n → hostname: ${exports.HOST}`,
+    `\n → port: ${exports.PORT}`,
+    `\n → version: ${exports.LIB_VERSION}`,
+    "\n",
+];
+exports.fastifyOptions = {
+    bodyLimit: 256 * 1024,
+    caseSensitive: true,
+    connectionTimeout: 30_000,
+    disableRequestLogging: false,
+    ignoreTrailingSlash: false,
+    keepAliveTimeout: 5000,
+    logger: true,
+    maxParamLength: 100,
+    onConstructorPoisoning: "error",
+    onProtoPoisoning: "error",
+    return503OnClosing: true,
+    trustProxy: parseTrustProxy(),
+};
+exports.compressOptions = {
+    global: true,
+    threshold: 2048,
+    zlibOptions: {
+        level: 6,
+    },
+};
+exports.helmetOptions = {
+    global: true,
+    contentSecurityPolicy: false,
+};
+exports.corsOptions = {
+    origin: process.env["CORS_ORIGIN"]
+        ? process.env["CORS_ORIGIN"].split(",").map((o) => o.trim())
+        : false,
+    methods: ["GET", "POST"],
+    allowedHeaders: ["Content-Type", "x-api-key"],
+    credentials: true,
+};
+exports.PROBE_PATHS = new Set([
+    "/health",
+    "/live",
+    "/ready",
+    "/metrics",
+]);
+const isProbePath = (url) => exports.PROBE_PATHS.has(url.split("?")[0]);
+exports.isProbePath = isProbePath;
+exports.rateLimitOptions = {
+    global: true,
+    max: 10,
+    timeWindow: "1 minute",
+    allowList: (req) => (0, exports.isProbePath)(req.url),
+    nameSpace: "crypto-server-rate-limit-",
+    addHeaders: {
+        "x-ratelimit-limit": true,
+        "x-ratelimit-remaining": true,
+        "x-ratelimit-reset": true,
+        "retry-after": true,
+    },
+    errorResponseBuilder(req, context) {
+        req.log.warn(`${req.ip} have been rateLimited`);
+        return {
+            statusCode: context.statusCode,
+            code: context.statusCode,
+            error: "Too Many Requests",
+            message: `Only ${context.max} requests are allowed per ${context.after}. Try again soon.`,
+            date: Date.now(),
+            expiresIn: context.ttl,
+        };
+    },
+};
+const resolveRateLimitMax = () => {
+    const parsed = Number(process.env["RATE_LIMIT_MAX"]);
+    return Number.isSafeInteger(parsed) && parsed > 0
+        ? parsed
+        : exports.rateLimitOptions.max;
+};
+exports.resolveRateLimitMax = resolveRateLimitMax;
+exports.healthCheckOptions = {
+    healthcheckUrl: "/health",
+    exposeUptime: true,
+};
+//# sourceMappingURL=constants.js.map

package/dist/config/env.d.ts

@@ -0,0 +1,16 @@
+export interface Config {
+    readonly host: string;
+    readonly port: number;
+    readonly protocol: "http" | "https";
+    readonly nodeEnv: "development" | "production" | "test";
+    readonly logLevel: "error" | "warn" | "info" | "debug";
+    readonly apiKey: string | undefined;
+    readonly corsOrigins: string[] | false;
+    readonly trustProxy: string[] | false;
+    readonly keyDir: string | undefined;
+    readonly keyOutDir: string | undefined;
+    readonly shutdownTimeoutMs: number;
+}
+export declare function loadConfig(): Config;
+export declare const config: Config;
+//# sourceMappingURL=env.d.ts.map

package/dist/config/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,MAAM;IAErB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;IAExD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAEvD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAEvC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAEtC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AA8BD,wBAAgB,UAAU,IAAI,MAAM,CAuDnC;AAKD,eAAO,MAAM,MAAM,EAAE,MAAqB,CAAC"}

package/dist/config/env.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.config = void 0;
+exports.loadConfig = loadConfig;
+const auth_policy_1 = require("./auth-policy");
+function optional(name, fallback) {
+    return process.env[name] ?? fallback;
+}
+function parsePort(val) {
+    const port = parseInt(val, 10);
+    if (!Number.isFinite(port) || port < 0 || port > 65535) {
+        throw new Error(`Invalid PORT: ${val} (must be 0–65535)`);
+    }
+    return port;
+}
+function parseCsvList(val) {
+    if (!val)
+        return false;
+    const entries = val
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    return entries.length > 0 ? entries : false;
+}
+function loadConfig() {
+    const errors = [];
+    const host = optional("HOST", "localhost");
+    const portStr = optional("PORT", "3000");
+    const protocol = optional("PROTOCOL", "http");
+    const nodeEnv = optional("NODE_ENV", "development");
+    const logLevel = optional("LOG_LEVEL", "info");
+    if (!["http", "https"].includes(protocol)) {
+        errors.push(`PROTOCOL must be "http" or "https", got "${protocol}"`);
+    }
+    if (!["development", "production", "test"].includes(nodeEnv)) {
+        errors.push(`NODE_ENV must be "development", "production", or "test", got "${nodeEnv}"`);
+    }
+    if (!["error", "warn", "info", "debug"].includes(logLevel)) {
+        errors.push(`LOG_LEVEL must be one of error|warn|info|debug, got "${logLevel}"`);
+    }
+    const authError = (0, auth_policy_1.authConfigError)(process.env);
+    if (authError)
+        errors.push(authError);
+    let port = 3000;
+    try {
+        port = parsePort(portStr);
+    }
+    catch (e) {
+        errors.push(e.message);
+    }
+    if (errors.length > 0) {
+        const msg = [
+            "Configuration validation failed:",
+            ...errors.map((e) => `  - ${e}`),
+        ].join("\n");
+        console.error(msg);
+        process.exit(1);
+    }
+    return Object.freeze({
+        host,
+        port,
+        protocol,
+        nodeEnv,
+        logLevel,
+        apiKey: process.env["CRYPTO_API_KEY"] || undefined,
+        corsOrigins: parseCsvList(process.env["CORS_ORIGIN"]),
+        trustProxy: parseCsvList(process.env["TRUSTED_PROXY_CIDRS"]),
+        keyDir: process.env["CRYPTO_KEY_DIR"] || undefined,
+        keyOutDir: process.env["CRYPTO_KEY_OUT_DIR"] || undefined,
+        shutdownTimeoutMs: parseInt(optional("SHUTDOWN_TIMEOUT_MS", "30000"), 10),
+    });
+}
+exports.config = loadConfig();
+//# sourceMappingURL=env.js.map

package/dist/enterprise/metering.d.ts

@@ -0,0 +1,19 @@
+import type { FastifyInstance } from "fastify";
+import type { LicenseTier, MeteringCheckResult, TenantQuota } from "./types";
+export declare const TIER_QUOTAS: Record<LicenseTier, TenantQuota>;
+export declare const DEFAULT_MAX_TENANTS = 10000;
+export declare class MeteringEngine {
+    private readonly maxTenants;
+    private readonly tenants;
+    constructor(maxTenants?: number);
+    get size(): number;
+    resolveTier(claim?: unknown): LicenseTier;
+    private getUsage;
+    private evictIfFull;
+    private refillTokens;
+    checkRequest(tenantKey: string, tier: LicenseTier, contentLength?: number, nowMs?: number): MeteringCheckResult;
+    reset(): void;
+}
+export declare const defaultMeteringEngine: MeteringEngine;
+export declare const registerMetering: (app: FastifyInstance, engine?: MeteringEngine) => void;
+//# sourceMappingURL=metering.d.ts.map

package/dist/enterprise/metering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metering.d.ts","sourceRoot":"","sources":["../../src/enterprise/metering.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EAEZ,MAAM,SAAS,CAAC;AAWjB,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAsBxD,CAAC;AAGF,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAY1C,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;gBAIvC,UAAU,GAAE,MAA4B;IAI3D,IAAW,IAAI,IAAI,MAAM,CAExB;IASM,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW;IAOhD,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,YAAY;IAqBb,YAAY,CACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,GAAE,MAAmB,GACzB,mBAAmB;IA4Df,KAAK,IAAI,IAAI;CAGrB;AAGD,eAAO,MAAM,qBAAqB,gBAAuB,CAAC;AA6B1D,eAAO,MAAM,gBAAgB,GAC3B,KAAK,eAAe,EACpB,SAAQ,cAAqC,KAC5C,IAgCF,CAAC"}

package/dist/enterprise/metering.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerMetering = exports.defaultMeteringEngine = exports.MeteringEngine = exports.DEFAULT_MAX_TENANTS = exports.TIER_QUOTAS = void 0;
+const constants_1 = require("../config/constants");
+exports.TIER_QUOTAS = {
+    community: {
+        tier: "community",
+        maxRequestsPerMinute: 60,
+        maxBytesPerPayload: 1024 * 1024,
+        allowQuantumOperations: true,
+        allowComplianceAudit: true,
+    },
+    enterprise: {
+        tier: "enterprise",
+        maxRequestsPerMinute: 1000,
+        maxBytesPerPayload: 10 * 1024 * 1024,
+        allowQuantumOperations: true,
+        allowComplianceAudit: true,
+    },
+    sovereign: {
+        tier: "sovereign",
+        maxRequestsPerMinute: 10000,
+        maxBytesPerPayload: 50 * 1024 * 1024,
+        allowQuantumOperations: true,
+        allowComplianceAudit: true,
+    },
+};
+exports.DEFAULT_MAX_TENANTS = 10_000;
+const ANONYMOUS_TENANT = "anonymous";
+class MeteringEngine {
+    maxTenants;
+    tenants = new Map();
+    constructor(maxTenants = exports.DEFAULT_MAX_TENANTS) {
+        this.maxTenants = maxTenants;
+    }
+    get size() {
+        return this.tenants.size;
+    }
+    resolveTier(claim) {
+        return typeof claim === "string" && Object.hasOwn(exports.TIER_QUOTAS, claim)
+            ? claim
+            : "community";
+    }
+    getUsage(tenantKey, tier, nowMs) {
+        let usage = this.tenants.get(tenantKey);
+        if (usage) {
+            this.tenants.delete(tenantKey);
+        }
+        else {
+            this.evictIfFull();
+            usage = {
+                tokens: exports.TIER_QUOTAS[tier].maxRequestsPerMinute,
+                lastRefillMs: nowMs,
+                totalRequests: 0,
+                totalBytes: 0,
+                tier,
+            };
+        }
+        this.tenants.set(tenantKey, usage);
+        return usage;
+    }
+    evictIfFull() {
+        if (this.tenants.size < this.maxTenants)
+            return;
+        const oldest = this.tenants.keys().next().value;
+        this.tenants.delete(oldest);
+    }
+    refillTokens(usage, quota, nowMs) {
+        const elapsedMs = nowMs - usage.lastRefillMs;
+        if (elapsedMs <= 0)
+            return;
+        const refillRatePerMs = quota.maxRequestsPerMinute / 60000;
+        const tokensToAdd = elapsedMs * refillRatePerMs;
+        usage.tokens = Math.min(quota.maxRequestsPerMinute, usage.tokens + tokensToAdd);
+        usage.lastRefillMs = nowMs;
+    }
+    checkRequest(tenantKey, tier, contentLength, nowMs = Date.now()) {
+        const quota = exports.TIER_QUOTAS[tier];
+        const usage = this.getUsage(tenantKey, tier, nowMs);
+        this.refillTokens(usage, quota, nowMs);
+        if (contentLength !== undefined &&
+            contentLength > quota.maxBytesPerPayload) {
+            const resetSeconds = Math.ceil((60000 - ((nowMs - usage.lastRefillMs) % 60000)) / 1000);
+            return {
+                allowed: false,
+                limit: quota.maxRequestsPerMinute,
+                remaining: Math.floor(Math.max(0, usage.tokens)),
+                resetSeconds: Math.max(1, resetSeconds),
+                tier,
+                error: `Payload size (${contentLength} bytes) exceeds tier limit of ${quota.maxBytesPerPayload} bytes`,
+                statusCode: 413,
+            };
+        }
+        if (usage.tokens < 1) {
+            const resetSeconds = Math.ceil((60000 - ((nowMs - usage.lastRefillMs) % 60000)) / 1000);
+            return {
+                allowed: false,
+                limit: quota.maxRequestsPerMinute,
+                remaining: 0,
+                resetSeconds: Math.max(1, resetSeconds),
+                tier,
+                error: `Tenant rate limit exceeded for tier '${tier}'. Limit: ${quota.maxRequestsPerMinute} req/min.`,
+                statusCode: 429,
+            };
+        }
+        usage.tokens -= 1;
+        usage.totalRequests += 1;
+        if (contentLength !== undefined && contentLength > 0) {
+            usage.totalBytes += contentLength;
+        }
+        const resetSeconds = Math.ceil((60000 - ((nowMs - usage.lastRefillMs) % 60000)) / 1000);
+        return {
+            allowed: true,
+            limit: quota.maxRequestsPerMinute,
+            remaining: Math.floor(Math.max(0, usage.tokens)),
+            resetSeconds: Math.max(1, resetSeconds),
+            tier,
+        };
+    }
+    reset() {
+        this.tenants.clear();
+    }
+}
+exports.MeteringEngine = MeteringEngine;
+exports.defaultMeteringEngine = new MeteringEngine();
+const isUnmeteredPath = (url) => {
+    const pathname = url.split("?")[0];
+    return ((0, constants_1.isProbePath)(pathname) ||
+        pathname.startsWith("/docs") ||
+        pathname === "/favicon.ico");
+};
+const parseContentLength = (raw) => raw !== undefined && !Number.isNaN(Number(raw)) ? Number(raw) : undefined;
+const registerMetering = (app, engine = new MeteringEngine()) => {
+    app.addHook("preHandler", async (request, reply) => {
+        if (isUnmeteredPath(request.url))
+            return;
+        const auth = request.auth;
+        const result = engine.checkRequest(auth?.sub ?? ANONYMOUS_TENANT, engine.resolveTier(auth?.tier), parseContentLength(request.headers["content-length"]));
+        reply.header("X-Tenant-RateLimit-Limit", result.limit);
+        reply.header("X-Tenant-RateLimit-Remaining", result.remaining);
+        reply.header("X-Tenant-RateLimit-Reset", result.resetSeconds);
+        reply.header("X-License-Tier", result.tier);
+        if (!result.allowed) {
+            const code = result.statusCode;
+            if (code === 429)
+                reply.header("Retry-After", result.resetSeconds);
+            return reply.code(code).send({
+                statusCode: code,
+                error: code === 413 ? "Payload Too Large" : "Too Many Requests",
+                message: result.error,
+                tier: result.tier,
+                limit: result.limit,
+                resetSeconds: result.resetSeconds,
+            });
+        }
+    });
+};
+exports.registerMetering = registerMetering;
+//# sourceMappingURL=metering.js.map

package/dist/enterprise/types.d.ts

@@ -0,0 +1,78 @@
+export type LicenseTier = "community" | "enterprise" | "sovereign";
+export interface TenantQuota {
+    readonly tier: LicenseTier;
+    readonly maxRequestsPerMinute: number;
+    readonly maxBytesPerPayload: number;
+    readonly allowQuantumOperations: boolean;
+    readonly allowComplianceAudit: boolean;
+}
+export interface TenantUsage {
+    tokens: number;
+    lastRefillMs: number;
+    totalRequests: number;
+    totalBytes: number;
+    tier: LicenseTier;
+}
+export interface MeteringCheckResult {
+    readonly allowed: boolean;
+    readonly limit: number;
+    readonly remaining: number;
+    readonly resetSeconds: number;
+    readonly tier: LicenseTier;
+    readonly error?: string;
+    readonly statusCode?: number;
+}
+export interface AlgorithmDeprecationRecord {
+    readonly algorithm: string;
+    readonly category: "asymmetric" | "symmetric" | "hash" | "pqc";
+    readonly sunsetDate: string;
+    readonly recommendedMigration: string;
+}
+export interface CryptographicAssetRecord {
+    readonly package: string;
+    readonly version: string;
+    readonly status: "production" | "hardened";
+    readonly fipsCompliance: string;
+}
+export interface DoraComplianceScorecard {
+    readonly standard: "DORA (EU 2022/2554)";
+    readonly article: "Article 9 & Article 13";
+    readonly complianceScore: number;
+    readonly status: "Compliant" | "Substantially Compliant" | "Action Required";
+    readonly quantumResistanceRatio: number;
+    readonly activePrimitivesCount: number;
+    readonly postQuantumPrimitivesCount: number;
+    readonly algorithmDeprecationSchedule: ReadonlyArray<AlgorithmDeprecationRecord>;
+    readonly cryptographicInventory: ReadonlyArray<CryptographicAssetRecord>;
+    readonly timestamp: string;
+}
+export interface CbomPayload {
+    readonly bomFormat: "CycloneDX";
+    readonly specVersion: "1.6";
+    readonly serialNumber: string;
+    readonly version: number;
+    readonly metadata: {
+        readonly timestamp: string;
+        readonly tools: ReadonlyArray<{
+            readonly vendor: string;
+            readonly name: string;
+            readonly version: string;
+        }>;
+        readonly component: {
+            readonly type: "framework";
+            readonly name: string;
+            readonly version: string;
+            readonly description: string;
+        };
+    };
+    readonly components: ReadonlyArray<{
+        readonly type: "cryptographic-asset";
+        readonly name: string;
+        readonly version: string;
+        readonly properties: ReadonlyArray<{
+            readonly name: string;
+            readonly value: string;
+        }>;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/enterprise/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/enterprise/types.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAGnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACxC;AAGD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;CACnB;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;IAC7E,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IACjF,QAAQ,CAAC,sBAAsB,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;YAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;SAC1B,CAAC,CAAC;QACH,QAAQ,CAAC,SAAS,EAAE;YAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;YAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;YACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;SACxB,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ"}

package/dist/enterprise/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/index.js

@@ -1,82 +1,46 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const endpoints_config_1 = __importDefault(require("./config/endpoints.config"));
-const accepts_1 = __importDefault(require("@fastify/accepts"));
-const etag_1 = __importDefault(require("@fastify/etag"));
-const fastify_1 = __importDefault(require("fastify"));
-const fastify_healthcheck_1 = __importDefault(require("fastify-healthcheck"));
+const telemetry_1 = require("./lib/telemetry");
+(0, telemetry_1.initTelemetry)();
+const env_1 = require("./config/env");
+const server_1 = require("./server");
 const logger_1 = __importDefault(require("./lib/logger"));
-const routes_1 = __importDefault(require("./routes"));
-const app = (0, fastify_1.default)({
-    bodyLimit: 256 * 1024 * 1,
-    caseSensitive: true,
-    connectionTimeout: 0,
-    disableRequestLogging: false,
-    ignoreTrailingSlash: false,
-    keepAliveTimeout: 5000,
-    logger: true,
-    maxParamLength: 100,
-    onConstructorPoisoning: "error",
-    onProtoPoisoning: "error",
-    return503OnClosing: true,
-    trustProxy: true,
-});
-const HOST = endpoints_config_1.default.HOST || "localhost";
-const PORT = endpoints_config_1.default.PORT || 3000;
-const PROTOCOL = endpoints_config_1.default.PROTOCOL || "http";
-const consoleOutput = [
-    "\n → protocol: " + PROTOCOL,
-    "\n → hostname: " + HOST,
-    "\n → port: " + PORT,
-    "\n",
-];
-logger_1.default.info("\n\nEnvironment details: " + consoleOutput);
-app.register(accepts_1.default);
-app.register(etag_1.default);
-app.register(fastify_healthcheck_1.default, { healthcheckUrl: "/health" });
-app.register(Promise.resolve().then(() => __importStar(require("@fastify/compress"))), {
-    global: true,
-});
-app.get("/", async () => {
-    return { hello: "Hello Crypto Server!" };
-});
-(0, routes_1.default)(app);
-const start = async () => {
-    try {
-        await app.listen(PORT, HOST).then(() => {
-            logger_1.default.info(`Server listening on http://${HOST}:${PORT}/`);
-        });
-    }
-    catch (err) {
-        app.log.error(err);
-        process.exit(1);
-    }
+const main = async () => {
+    const server = await (0, server_1.init)();
+    await server.ready();
+    await server.listen({ port: env_1.config.port, host: env_1.config.host });
+    logger_1.default.info(`Server listening on ${env_1.config.protocol}://${env_1.config.host}:${env_1.config.port}/`);
+    logger_1.default.info(`Swagger docs at ${env_1.config.protocol}://${env_1.config.host}:${env_1.config.port}/docs`);
+    let isShuttingDown = false;
+    const shutdown = async (signal) => {
+        if (isShuttingDown)
+            return;
+        isShuttingDown = true;
+        logger_1.default.info(`Received ${signal} — shutting down gracefully...`);
+        const forceTimer = setTimeout(() => {
+            logger_1.default.error(`Shutdown timed out after ${env_1.config.shutdownTimeoutMs}ms — forcing exit`);
+            process.exit(1);
+        }, env_1.config.shutdownTimeoutMs);
+        forceTimer.unref();
+        try {
+            await server.close();
+            await (0, telemetry_1.shutdownTelemetry)();
+            logger_1.default.info("All connections drained. Goodbye.");
+            process.exit(0);
+        }
+        catch (err) {
+            logger_1.default.error("Error during shutdown", err instanceof Error ? err : undefined);
+            process.exit(1);
+        }
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
 };
-start();
+main().catch((err) => {
+    logger_1.default.error(`Server failed to start: ${err instanceof Error ? err.message : "Unknown error"}`);
+    process.exit(1);
+});
 //# sourceMappingURL=index.js.map

package/dist/lib/auth.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+export declare const SCOPES: readonly ["crypto:encrypt", "crypto:decrypt", "crypto:sign", "crypto:verify", "crypto:hash", "crypto:kdf", "crypto:keys", "crypto:admin"];
+export type Scope = (typeof SCOPES)[number];
+export interface AuthPayload {
+    sub: string;
+    scopes: Scope[];
+    iat?: number;
+    exp?: number;
+}
+export declare function registerAuth(app: FastifyInstance): Promise<void>;
+export declare function authenticate(request: FastifyRequest, reply: FastifyReply): Promise<AuthPayload | null>;
+export declare function hasScope(payload: AuthPayload, required: Scope): boolean;
+export declare function requireScope(payload: AuthPayload, scope: Scope, reply: FastifyReply): boolean;
+//# sourceMappingURL=auth.d.ts.map