@sebastienrousseau/crypto-server 0.0.8 → 0.0.24

package/dist/routes/v2/stream-schemas.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_MULTI_PQ_DECRYPT_SCHEMA = exports.STREAM_MULTI_PQ_ENCRYPT_SCHEMA = exports.STREAM_PQ_DECRYPT_SCHEMA = exports.STREAM_PQ_ENCRYPT_SCHEMA = exports.ISO20022_SCHEMA = exports.VERIFY_SCHEMA = exports.SIGN_SCHEMA = void 0;
+const keys_1 = require("../../utils/keys");
+exports.SIGN_SCHEMA = {
+    tags: ["Streaming"],
+    summary: "Batch sign messages with sub-millisecond throughput",
+    description: "Process high-throughput batch digital signing operations over multiple payloads.",
+    body: {
+        type: "object",
+        required: ["items"],
+        additionalProperties: false,
+        properties: {
+            items: {
+                type: "array",
+                minItems: 1,
+                maxItems: 1000,
+                items: {
+                    type: "object",
+                    required: ["id", "message", "keyId"],
+                    additionalProperties: false,
+                    properties: {
+                        id: { type: "string" },
+                        message: { type: "string", minLength: 1 },
+                        keyId: keys_1.KEY_ID_SCHEMA,
+                    },
+                },
+            },
+        },
+    },
+};
+exports.VERIFY_SCHEMA = {
+    tags: ["Streaming"],
+    summary: "Batch verify digital signatures",
+    description: "Batch verification pipeline for high-concurrency payment and transaction verification.",
+    body: {
+        type: "object",
+        required: ["items"],
+        additionalProperties: false,
+        properties: {
+            items: {
+                type: "array",
+                minItems: 1,
+                maxItems: 1000,
+                items: {
+                    type: "object",
+                    required: ["id", "message", "signature", "publicKey"],
+                    additionalProperties: false,
+                    properties: {
+                        id: { type: "string" },
+                        message: { type: "string", minLength: 1 },
+                        signature: { type: "string", minLength: 1 },
+                        publicKey: { type: "string", minLength: 64, maxLength: 64 },
+                    },
+                },
+            },
+        },
+    },
+};
+exports.ISO20022_SCHEMA = {
+    tags: ["Wholesale Payments"],
+    summary: "Verify ISO 20022 post-quantum dual-signature envelope",
+    description: "Validates the payload digest and both the Ed25519 and ML-DSA signatures of a pacs.008, pain.001 or camt.053 envelope. Signatures are checked against trustedKeys, the signer's public keys from the caller's own registry; the public keys inside the envelope are ignored.",
+    body: {
+        type: "object",
+        required: ["envelope", "payload", "trustedKeys"],
+        additionalProperties: false,
+        properties: {
+            trustedKeys: {
+                type: "object",
+                required: ["classicalPublicKey", "postQuantumPublicKey"],
+                additionalProperties: false,
+                properties: {
+                    classicalPublicKey: { type: "string", minLength: 1 },
+                    postQuantumPublicKey: { type: "string", minLength: 1 },
+                },
+            },
+            envelope: {
+                type: "object",
+                required: [
+                    "messageId",
+                    "messageType",
+                    "payloadDigest",
+                    "digestAlgorithm",
+                    "timestamp",
+                    "classical",
+                    "postQuantum",
+                ],
+                additionalProperties: false,
+                properties: {
+                    messageId: { type: "string" },
+                    messageType: {
+                        type: "string",
+                        enum: ["pacs.008", "pain.001", "camt.053", "generic"],
+                    },
+                    payloadDigest: { type: "string" },
+                    digestAlgorithm: {
+                        type: "string",
+                        enum: ["sha256", "sha384", "sha512"],
+                    },
+                    timestamp: { type: "string" },
+                    classical: {
+                        type: "object",
+                        required: ["algorithm", "signature", "publicKey"],
+                        additionalProperties: false,
+                        properties: {
+                            algorithm: { type: "string" },
+                            signature: { type: "string" },
+                            publicKey: { type: "string" },
+                        },
+                    },
+                    postQuantum: {
+                        type: "object",
+                        required: ["algorithm", "signature", "publicKey"],
+                        additionalProperties: false,
+                        properties: {
+                            algorithm: {
+                                type: "string",
+                                enum: ["ml-dsa-44", "ml-dsa-65", "ml-dsa-87"],
+                            },
+                            signature: { type: "string" },
+                            publicKey: { type: "string" },
+                        },
+                    },
+                },
+            },
+            payload: {},
+        },
+    },
+};
+exports.STREAM_PQ_ENCRYPT_SCHEMA = {
+    tags: ["Streaming"],
+    summary: "Encrypt stream with hybrid post-quantum AEAD",
+    description: "Encrypts plaintext using chunked hybrid post-quantum STREAM (X25519 + ML-KEM-768 + XChaCha20-Poly1305).",
+    body: {
+        type: "object",
+        required: ["x25519PublicKey", "mlKemPublicKey", "plaintext"],
+        additionalProperties: false,
+        properties: {
+            x25519PublicKey: { type: "string", minLength: 64, maxLength: 64 },
+            mlKemPublicKey: { type: "string", minLength: 1 },
+            plaintext: { type: "string", minLength: 1 },
+            chunkSize: { type: "integer", minimum: 64, maximum: 1048576 },
+        },
+    },
+};
+exports.STREAM_PQ_DECRYPT_SCHEMA = {
+    tags: ["Streaming"],
+    summary: "Decrypt stream with server-held hybrid post-quantum key",
+    description: "Decrypts hybrid post-quantum STREAM ciphertext using a server-held x25519-ml-kem-768 key.",
+    body: {
+        type: "object",
+        required: ["keyId", "ciphertext"],
+        additionalProperties: false,
+        properties: {
+            keyId: keys_1.KEY_ID_SCHEMA,
+            ciphertext: { type: "string", minLength: 1 },
+            chunkSize: { type: "integer", minimum: 64, maximum: 1048576 },
+        },
+    },
+};
+exports.STREAM_MULTI_PQ_ENCRYPT_SCHEMA = {
+    tags: ["Streaming"],
+    summary: "Encrypt stream for multiple recipients with hybrid post-quantum AEAD",
+    description: "Encrypts plaintext for multiple recipients using hybrid post-quantum key encapsulation and chunked AEAD.",
+    body: {
+        type: "object",
+        required: ["recipients", "plaintext"],
+        additionalProperties: false,
+        properties: {
+            recipients: {
+                type: "array",
+                minItems: 1,
+                maxItems: 100,
+                items: {
+                    type: "object",
+                    required: ["recipientId", "x25519PublicKey", "mlKemPublicKey"],
+                    additionalProperties: false,
+                    properties: {
+                        recipientId: { type: "string", minLength: 1, maxLength: 255 },
+                        x25519PublicKey: { type: "string", minLength: 64, maxLength: 64 },
+                        mlKemPublicKey: { type: "string", minLength: 1 },
+                    },
+                },
+            },
+            plaintext: { type: "string", minLength: 1 },
+            chunkSize: { type: "integer", minimum: 1024, maximum: 16777216 },
+        },
+    },
+};
+exports.STREAM_MULTI_PQ_DECRYPT_SCHEMA = {
+    tags: ["Streaming"],
+    summary: "Decrypt multi-recipient stream with server-held hybrid post-quantum key",
+    description: "Decrypts multi-recipient hybrid post-quantum STREAM ciphertext using a server-held x25519-ml-kem-768 key.",
+    body: {
+        type: "object",
+        required: ["keyId", "ciphertext"],
+        additionalProperties: false,
+        properties: {
+            keyId: keys_1.KEY_ID_SCHEMA,
+            recipientId: { type: "string", minLength: 1, maxLength: 255 },
+            ciphertext: { type: "string", minLength: 1 },
+            chunkSize: { type: "integer", minimum: 1024, maximum: 16777216 },
+        },
+    },
+};
+//# sourceMappingURL=stream-schemas.js.map

package/dist/routes/v2/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAIE"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;yBA6U/C,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAQE"}

package/dist/routes/v2/stream.js

@@ -1,160 +1,44 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
-const iso20022_1 = require("@sebastienrousseau/crypto-lib/dist/protocols/iso20022");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
+const protocols_1 = require("@sebastienrousseau/crypto-lib/protocols");
 const route_helpers_1 = require("../../utils/route-helpers");
-const SIGN_SCHEMA = {
-    tags: ["Streaming"],
-    summary: "Batch sign messages with sub-millisecond throughput",
-    description: "Process high-throughput batch digital signing operations over multiple payloads.",
-    body: {
-        type: "object",
-        required: ["items"],
-        additionalProperties: false,
-        properties: {
-            items: {
-                type: "array",
-                minItems: 1,
-                maxItems: 1000,
-                items: {
-                    type: "object",
-                    required: ["id", "message", "privateKey"],
-                    additionalProperties: false,
-                    properties: {
-                        id: { type: "string" },
-                        message: { type: "string", minLength: 1 },
-                        privateKey: { type: "string", minLength: 64, maxLength: 64 },
-                    },
-                },
-            },
-        },
-    },
-};
-const VERIFY_SCHEMA = {
-    tags: ["Streaming"],
-    summary: "Batch verify digital signatures",
-    description: "Batch verification pipeline for high-concurrency payment and transaction verification.",
-    body: {
-        type: "object",
-        required: ["items"],
-        additionalProperties: false,
-        properties: {
-            items: {
-                type: "array",
-                minItems: 1,
-                maxItems: 1000,
-                items: {
-                    type: "object",
-                    required: ["id", "message", "signature", "publicKey"],
-                    additionalProperties: false,
-                    properties: {
-                        id: { type: "string" },
-                        message: { type: "string", minLength: 1 },
-                        signature: { type: "string", minLength: 1 },
-                        publicKey: { type: "string", minLength: 64, maxLength: 64 },
-                    },
-                },
-            },
-        },
-    },
-};
-const ISO20022_SCHEMA = {
-    tags: ["Wholesale Payments"],
-    summary: "Verify ISO 20022 post-quantum dual-signature envelope",
-    description: "Validates the payload digest and both the Ed25519 and ML-DSA signatures of a pacs.008, pain.001 or camt.053 envelope. Signatures are checked against trustedKeys, the signer's public keys from the caller's own registry; the public keys inside the envelope are ignored.",
-    body: {
-        type: "object",
-        required: ["envelope", "payload", "trustedKeys"],
-        additionalProperties: false,
-        properties: {
-            trustedKeys: {
-                type: "object",
-                required: ["classicalPublicKey", "postQuantumPublicKey"],
-                additionalProperties: false,
-                properties: {
-                    classicalPublicKey: { type: "string", minLength: 1 },
-                    postQuantumPublicKey: { type: "string", minLength: 1 },
-                },
-            },
-            envelope: {
-                type: "object",
-                required: [
-                    "messageId",
-                    "messageType",
-                    "payloadDigest",
-                    "digestAlgorithm",
-                    "timestamp",
-                    "classical",
-                    "postQuantum",
-                ],
-                additionalProperties: false,
-                properties: {
-                    messageId: { type: "string" },
-                    messageType: {
-                        type: "string",
-                        enum: ["pacs.008", "pain.001", "camt.053", "generic"],
-                    },
-                    payloadDigest: { type: "string" },
-                    digestAlgorithm: {
-                        type: "string",
-                        enum: ["sha256", "sha384", "sha512"],
-                    },
-                    timestamp: { type: "string" },
-                    classical: {
-                        type: "object",
-                        required: ["algorithm", "signature", "publicKey"],
-                        additionalProperties: false,
-                        properties: {
-                            algorithm: { type: "string" },
-                            signature: { type: "string" },
-                            publicKey: { type: "string" },
-                        },
-                    },
-                    postQuantum: {
-                        type: "object",
-                        required: ["algorithm", "signature", "publicKey"],
-                        additionalProperties: false,
-                        properties: {
-                            algorithm: {
-                                type: "string",
-                                enum: ["ml-dsa-44", "ml-dsa-65", "ml-dsa-87"],
-                            },
-                            signature: { type: "string" },
-                            publicKey: { type: "string" },
-                        },
-                    },
-                },
-            },
-            payload: {},
-        },
-    },
-};
+const keys_1 = require("../../utils/keys");
+const stream_schemas_1 = require("./stream-schemas");
+async function resolveBatchKeys(request, items) {
+    const keys = new Map();
+    for (const keyId of new Set(items.map((i) => i.keyId))) {
+        keys.set(keyId, await (0, keys_1.resolveKey)(request, keyId, ["ed25519"]));
+    }
+    return keys;
+}
 function registerBatchSign(app) {
-    app.post("/v2/stream/sign", { schema: SIGN_SCHEMA }, async (request, reply) => {
-        try {
-            const { items } = request.body;
-            const signatures = items.map((item) => {
-                const res = (0, crypto_lib_1.ed25519Sign)(item.privateKey, item.message);
-                return {
-                    id: item.id,
-                    signature: res.signature,
-                    algorithm: "ed25519",
-                };
-            });
-            return reply.send({
-                data: {
-                    count: signatures.length,
-                    signatures,
-                },
-            });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Batch signing");
-        }
+    app.post("/v2/stream/sign", { schema: stream_schemas_1.SIGN_SCHEMA }, async (request, reply) => {
+        const { items } = request.body;
+        const keys = await resolveBatchKeys(request, items);
+        const signatures = items.map((item) => {
+            const key = keys.get(item.keyId);
+            const res = (0, crypto_lib_1.ed25519Sign)(key.privateParts["privateKey"], item.message);
+            return {
+                id: item.id,
+                signature: res.signature,
+                algorithm: "ed25519",
+            };
+        });
+        return reply.send({
+            data: {
+                count: signatures.length,
+                signatures,
+            },
+        });
     });
 }
 function registerBatchVerify(app) {
-    app.post("/v2/stream/verify", { schema: VERIFY_SCHEMA }, async (request, reply) => {
+    app.post("/v2/stream/verify", {
+        schema: stream_schemas_1.VERIFY_SCHEMA,
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+    }, async (request, reply) => {
         try {
             const { items } = request.body;
             let validCount = 0;
@@ -184,10 +68,13 @@ function registerBatchVerify(app) {
     });
 }
 function registerIso20022Verify(app) {
-    app.post("/v2/stream/iso20022", { schema: ISO20022_SCHEMA }, async (request, reply) => {
+    app.post("/v2/stream/iso20022", {
+        schema: stream_schemas_1.ISO20022_SCHEMA,
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+    }, async (request, reply) => {
         try {
             const { envelope, payload, trustedKeys } = request.body;
-            const result = (0, iso20022_1.verifyIso20022Payment)(envelope, payload, {
+            const result = (0, protocols_1.verifyIso20022Payment)(envelope, payload, {
                 classicalPublicKeyHex: trustedKeys.classicalPublicKey,
                 postQuantumPublicKeyHex: trustedKeys.postQuantumPublicKey,
             });
@@ -198,9 +85,115 @@ function registerIso20022Verify(app) {
         }
     });
 }
+function registerStreamPqEncrypt(app) {
+    app.post("/v2/stream/pq-encrypt", { schema: stream_schemas_1.STREAM_PQ_ENCRYPT_SCHEMA }, async (request, reply) => {
+        try {
+            const { x25519PublicKey, mlKemPublicKey, plaintext, chunkSize } = request.body;
+            const ptBytes = Buffer.from(plaintext, "utf8");
+            const res = (0, streaming_1.streamPqEncrypt)({
+                recipientX25519Public: x25519PublicKey,
+                recipientMlKemPublic: mlKemPublicKey,
+                plaintext: ptBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            return reply.send({
+                data: {
+                    ciphertext: Buffer.from(res.ciphertext).toString("base64"),
+                    algorithm: res.algorithm,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "PQ stream encryption");
+        }
+    });
+}
+function registerStreamPqDecrypt(app) {
+    app.post("/v2/stream/pq-decrypt", { schema: stream_schemas_1.STREAM_PQ_DECRYPT_SCHEMA }, async (request, reply) => {
+        const { keyId, ciphertext, chunkSize } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519-ml-kem-768"]);
+        try {
+            const ctBytes = Buffer.from(ciphertext, "base64");
+            const decrypted = (0, streaming_1.streamPqDecrypt)({
+                recipientX25519Secret: key.privateParts["x25519PrivateKey"],
+                recipientMlKemSecret: key.privateParts["mlKemSecretKey"],
+                ciphertext: ctBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            const plaintext = Buffer.from(decrypted).toString("utf8");
+            (0, crypto_lib_1.wipeMemory)(decrypted);
+            return reply.send({ data: { plaintext } });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "PQ stream decryption");
+        }
+    });
+}
+function registerStreamMultiPqEncrypt(app) {
+    app.post("/v2/stream/multi-pq-encrypt", { schema: stream_schemas_1.STREAM_MULTI_PQ_ENCRYPT_SCHEMA }, async (request, reply) => {
+        try {
+            const { recipients, plaintext, chunkSize } = request.body;
+            const ptBytes = Buffer.from(plaintext, "utf8");
+            const res = (0, streaming_1.streamMultiPqEncrypt)({
+                recipients: recipients.map((r) => ({
+                    recipientId: r.recipientId,
+                    recipientX25519Public: r.x25519PublicKey,
+                    recipientMlKemPublic: r.mlKemPublicKey,
+                })),
+                plaintext: ptBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            (0, crypto_lib_1.wipeMemory)(ptBytes);
+            return reply.send({
+                data: {
+                    ciphertext: Buffer.from(res.ciphertext).toString("base64"),
+                    algorithm: res.algorithm,
+                    recipientCount: res.recipientCount,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Multi-PQ stream encryption");
+        }
+    });
+}
+function registerStreamMultiPqDecrypt(app) {
+    app.post("/v2/stream/multi-pq-decrypt", {
+        schema: stream_schemas_1.STREAM_MULTI_PQ_DECRYPT_SCHEMA,
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+    }, async (request, reply) => {
+        const { keyId, recipientId, ciphertext, chunkSize } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519-ml-kem-768"]);
+        try {
+            const ctBytes = Buffer.from(ciphertext, "base64");
+            const decrypted = (0, streaming_1.streamMultiPqDecrypt)({
+                ...(recipientId !== undefined ? { recipientId } : {}),
+                recipientX25519Secret: key.privateParts["x25519PrivateKey"],
+                recipientMlKemSecret: key.privateParts["mlKemSecretKey"],
+                ciphertext: ctBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            const plaintext = Buffer.from(decrypted.plaintext).toString("utf8");
+            (0, crypto_lib_1.wipeMemory)(decrypted.plaintext);
+            return reply.send({
+                data: {
+                    plaintext,
+                    recipientId: decrypted.recipientId,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Multi-PQ stream decryption");
+        }
+    });
+}
 exports.default = (app) => {
     registerBatchSign(app);
     registerBatchVerify(app);
     registerIso20022Verify(app);
+    registerStreamPqEncrypt(app);
+    registerStreamPqDecrypt(app);
+    registerStreamMultiPqEncrypt(app);
+    registerStreamMultiPqDecrypt(app);
 };
 //# sourceMappingURL=stream.js.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AA4CnC,iBAAe,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CA0DtD;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAuCnC,iBAAe,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAgFtD;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/server.js

@@ -50,12 +50,15 @@ const swagger_ui_1 = __importDefault(require("@fastify/swagger-ui"));
 const crypto_1 = require("crypto");
 const logger_1 = __importDefault(require("./lib/logger"));
 const auth_1 = require("./lib/auth");
+const auth_policy_1 = require("./config/auth-policy");
 const metering_1 = require("./enterprise/metering");
+const key_store_1 = require("./lib/key-store");
+const kdf_runner_1 = require("./lib/kdf-runner");
+const problem_1 = require("./lib/problem");
+const trace_1 = require("./utils/trace");
+const opaque_store_1 = require("./lib/opaque-store");
 const routes_1 = __importDefault(require("./routes"));
 const fastify = __importStar(require("fastify"));
-function isPublicPath(url) {
-    return (0, constants_1.isProbePath)(url) || url.startsWith("/docs");
-}
 async function registerDocs(app) {
     await app.register(swagger_1.default, {
         openapi: {
@@ -82,10 +85,16 @@ async function registerDocs(app) {
 }
 async function init() {
     const app = fastify.fastify(constants_1.fastifyOptions);
+    const registered = [];
+    app.addHook("onRoute", (route) => {
+        registered.push({ method: route.method, url: route.url });
+    });
     logger_1.default.info("\n\nEnvironment details: " + constants_1.consoleOutput);
+    (0, problem_1.registerProblemHandlers)(app);
     app.addHook("onRequest", async (request, reply) => {
         const reqId = request.headers["x-request-id"] ?? (0, crypto_1.randomUUID)();
         reply.header("x-request-id", reqId);
+        (0, trace_1.propagateTraceContext)(request, reply);
     });
     app.addHook("onSend", async (request, reply) => {
         if (request.url.startsWith("/v2/")) {
@@ -107,18 +116,23 @@ async function init() {
     });
     await (0, auth_1.registerAuth)(app);
     app.addHook("onRequest", async (request, reply) => {
-        if (isPublicPath(request.url))
+        if ((0, auth_policy_1.isPublicRoute)(request.url))
             return;
         const auth = await (0, auth_1.authenticate)(request, reply);
-        if (!auth)
+        if (!auth || !(0, auth_1.authorizeRoute)(request, reply, auth))
             return reply;
         request.auth = auth;
     });
+    app.decorate("keyStore", (0, key_store_1.keyStoreFromEnv)());
+    app.decorate("kdf", new kdf_runner_1.KdfRunner());
+    app.decorate("opaqueStore", new opaque_store_1.OpaqueStore());
+    app.addHook("onClose", () => app.kdf.close());
     (0, metering_1.registerMetering)(app);
     await app.register(async (scope) => {
         (0, routes_1.default)(scope);
     });
     await app.ready();
+    (0, auth_policy_1.assertRoutesCovered)(registered);
     return app;
 }
 //# sourceMappingURL=server.js.map

package/dist/utils/keys.d.ts

@@ -0,0 +1,17 @@
+import type { FastifyRequest } from "fastify";
+import { type KeyParts, type KeyStore, type StoredKey } from "../lib/key-store";
+declare module "fastify" {
+    interface FastifyInstance {
+        keyStore: KeyStore;
+    }
+}
+export declare const KEY_ID_SCHEMA: {
+    readonly type: "string";
+    readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
+    readonly description: "Identifier of a server-held key, returned by a key-generation route.";
+};
+export declare function resolveKey(request: FastifyRequest, keyId: string, algorithms?: readonly string[]): Promise<StoredKey>;
+export declare function storeKey(request: FastifyRequest, algorithm: string, publicParts: KeyParts, privateParts: KeyParts): Promise<StoredKey>;
+export declare function serverPgpPrivateKey(): Promise<string>;
+export declare function publicView(key: StoredKey): Record<string, string>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/utils/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/utils/keys.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QAEvB,QAAQ,EAAE,QAAQ,CAAC;KACpB;CACF;AAGD,eAAO,MAAM,aAAa;;;;CAKhB,CAAC;AAeX,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,SAAS,CAAC,CAEpB;AAGD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE,QAAQ,GACrB,OAAO,CAAC,SAAS,CAAC,CAOpB;AAOD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAG3D;AAGD,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjE"}

package/dist/utils/keys.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_ID_SCHEMA = void 0;
+exports.resolveKey = resolveKey;
+exports.storeKey = storeKey;
+exports.serverPgpPrivateKey = serverPgpPrivateKey;
+exports.publicView = publicView;
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
+const key_store_1 = require("../lib/key-store");
+exports.KEY_ID_SCHEMA = {
+    type: "string",
+    pattern: key_store_1.KEY_ID_PATTERN,
+    description: "Identifier of a server-held key, returned by a key-generation route.",
+};
+function principalOf(request) {
+    return request.auth.sub;
+}
+function resolveKey(request, keyId, algorithms) {
+    return request.server.keyStore.get(keyId, principalOf(request), algorithms);
+}
+function storeKey(request, algorithm, publicParts, privateParts) {
+    return request.server.keyStore.put({
+        algorithm,
+        owner: principalOf(request),
+        publicParts,
+        privateParts,
+    });
+}
+async function serverPgpPrivateKey() {
+    const { privateKeyArmored } = await (0, pgp_1.loadKeystore)();
+    return Buffer.from(privateKeyArmored, "latin1").toString("base64");
+}
+function publicView(key) {
+    return { keyId: key.keyId, algorithm: key.algorithm, ...key.publicParts };
+}
+//# sourceMappingURL=keys.js.map

package/dist/utils/route-helpers.d.ts

@@ -7,9 +7,5 @@ export declare function classifyCryptoError(error: unknown, request: {
     log: {
         error: (err: unknown, msg: string) => void;
     };
-}, reply: {
-    status: (code: number) => {
-        send: (body: unknown) => unknown;
-    };
-}, operation: string): unknown;
+}, reply: FastifyReply, operation: string): FastifyReply;
 //# sourceMappingURL=route-helpers.d.ts.map