@shellicar/core-config 2.1.3 → 2.1.5

package/CHANGELOG.md

@@ -0,0 +1,102 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.1.5] - 2026-04-15
+
+### Changed
+
+- Updated dependencies to latest versions
+
+## [2.1.4] - 2026-02-28
+
+### Changed
+
+- Updated @shellicar/build-clean to 1.2.3, biome to 2.4.4
+- Updated all dependencies to latest versions
+
+### Security
+
+- Fixed CVE-2026-25547 in @isaacs/brace-expansion ([GHSA-7h2j-956f-4vf2](https://github.com/advisories/GHSA-7h2j-956f-4vf2))
+- Fixed CVE-2026-26996 in minimatch ([GHSA-3ppc-4f35-3m26](https://github.com/advisories/GHSA-3ppc-4f35-3m26))
+
+## [2.1.3] - 2026-01-20
+
+### Fixed
+
+- Export factory interface returned by `createFactory`
+
+## [2.1.2] - 2025-12-26
+
+### Changed
+
+- Updated all dependencies to latest versions
+
+## [2.1.1] - 2025-10-24
+
+### Changed
+
+- Updated all dependencies to latest versions
+
+## [2.1.0] - 2025-08-24
+
+### Changed
+
+- Updated all dependencies to latest versions
+
+## [2.0.0] - 2025-08-03
+
+### Changed
+
+- Exports now use abstract interfaces instead of concrete classes for better type safety
+- `SecureString`, `SecureConnectionString`, and `SecureURL` classes are no longer exported, use `createFactory()` instead
+- `createFactory()` now takes a configuration object instead of a string parameter
+- Extracted proper abstract interfaces for better type safety and extensibility
+- Moved type definitions to dedicated interfaces file for better organization
+
+### Security
+
+- Replaced plain text memory storage with AES-256-GCM encryption for all secret values
+- Added `EncryptedValue` class for secure in-memory storage with unique per-instance encryption keys
+- Added configurable encryption provider to allow custom encryption implementations
+
+## [1.0.1] - 2025-01-08
+
+### Changed
+
+- Use `hs256` prefix for HMAC-SHA256
+- Fix zod example in README
+
+## [1.0.0] - 2025-01-08
+
+### Added
+
+- `secret` parameter to use `HMAC-SHA256`
+- `createFactory` method to simplify secret creation
+- Add `readme` example project
+
+### Changed
+
+- Examples in README
+- Use `packages` and `examples` monorepo structure
+- Use `tsup-node`
+
+## [0.1.0] - 2025-01-07
+
+### Added
+
+- Initial release
+
+[2.1.5]: https://github.com/shellicar/ecosystem/releases/tag/core-config@2.1.5
+[2.1.4]: https://github.com/shellicar/ecosystem/releases/tag/2.1.4
+[2.1.3]: https://github.com/shellicar/ecosystem/releases/tag/2.1.3
+[2.1.2]: https://github.com/shellicar/ecosystem/releases/tag/2.1.2
+[2.1.1]: https://github.com/shellicar/ecosystem/releases/tag/2.1.1
+[2.1.0]: https://github.com/shellicar/ecosystem/releases/tag/2.1.0
+[2.0.0]: https://github.com/shellicar/ecosystem/releases/tag/2.0.0
+[1.0.1]: https://github.com/shellicar/ecosystem/releases/tag/1.0.1
+[1.0.0]: https://github.com/shellicar/ecosystem/releases/tag/1.0.0
+[0.1.0]: https://github.com/shellicar/ecosystem/releases/tag/0.1.0

package/README.md

@@ -3,7 +3,13 @@
 > A library for securely handling sensitive configuration values like connection strings, URLs, and secrets.
 
 [![npm package](https://img.shields.io/npm/v/@shellicar/core-config.svg)](https://npmjs.com/package/@shellicar/core-config)
-[![build status](https://github.com/shellicar/core-config/actions/workflows/node.js.yml/badge.svg)](https://github.com/shellicar/core-config/actions/workflows/node.js.yml)
+[![build status](https://github.com/shellicar/ecosystem/actions/workflows/node.js.yml/badge.svg)](https://github.com/shellicar/ecosystem/actions/workflows/node.js.yml)
+
+## Features
+
+- 🔐 **SecureString** - Safely handle sensitive string values with automatic hashing for logs and serialisation
+- 🔗 **SecureConnectionString** - Parse and protect connection strings with configurable secret key detection
+- 🌐 **SecureURL** - Handle URLs while protecting sensitive components like passwords
 
 ## Installation & Quick Start
 
@@ -25,6 +31,163 @@ console.log(factory.connectionString('Server=myserver.uri;Password=myPassword123
 console.log(factory.url(new URL('http://myuser:myPassword123@myserver.uri')));
 ```
 
-## Documentation
+<!-- BEGIN_ECOSYSTEM -->
+
+## @shellicar TypeScript Ecosystem
+
+### Core Libraries
+
+- [`@shellicar/core-config`](https://github.com/shellicar/ecosystem/tree/main/packages/core-config) - A library for securely handling sensitive configuration values like connection strings, URLs, and secrets.
+- [`@shellicar/core-di`](https://github.com/shellicar/core-di) - A basic dependency injection library.
+
+### Reference Architectures
+
+- [`@shellicar/reference-foundation`](https://github.com/shellicar/reference-foundation) - A comprehensive starter repository. Illustrates individual concepts.
+- [`@shellicar/reference-enterprise`](https://github.com/shellicar/reference-enterprise) - A comprehensive starter repository. Can be used as the basis for creating a new Azure application workload.
+
+### Build Tools
+
+- [`@shellicar/build-clean`](https://github.com/shellicar/build-clean) - Build plugin that automatically cleans unused files from output directories.
+- [`@shellicar/build-version`](https://github.com/shellicar/build-version) - Build plugin that calculates and exposes version information through a virtual module import.
+- [`@shellicar/build-graphql`](https://github.com/shellicar/build-graphql) - Build plugin that loads GraphQL files and makes them available through a virtual module import.
+
+### Framework Adapters
+
+- [`@shellicar/svelte-adapter-azure-functions`](https://github.com/shellicar/svelte-adapter-azure-functions) - A [SvelteKit adapter](https://kit.svelte.dev/docs/adapters) that builds your app into an Azure Function.
+- [`@shellicar/cosmos-query-builder`](https://github.com/shellicar/cosmos-query-builder) - Helper class for type safe advanced queries for Cosmos DB (Sql Core).
+
+### Logging & Monitoring
+
+- [`@shellicar/winston-azure-application-insights`](https://github.com/shellicar/winston-azure-application-insights) - An [Azure Application Insights](https://azure.microsoft.com/en-us/services/application-insights/) transport for [Winston](https://github.com/winstonjs/winston) logging library.
+- [`@shellicar/pino-applicationinsights-transport`](https://github.com/shellicar/pino-applicationinsights-transport) - [Azure Application Insights](https://azure.microsoft.com/en-us/services/application-insights) transport for [pino](https://github.com/pinojs/pino)
+
+<!-- END_ECOSYSTEM -->
+
+## Motivation
+
+To make storing and comparing configuration including secrets easy and simple.
+
+You can easily output or display your configuration, even secret/secure values, without having to manually hash them or extract them.
+
+## Feature Examples
+
+Three main classes, `SecureString`, `SecureConnectionString`, and `SecureURL`.
+
+See [readme examples](./examples/readme/src) for example source code.
+
+- Handle strings.
+
+```typescript
+import { createFactory } from '@shellicar/core-config';
+
+const factory = createFactory();
+const secret = factory.string('myPassword123');
+
+console.log(secret.toString()); 
+// sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716
+
+console.log(JSON.stringify({ secret }));
+// {"secret":"sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716"}
+```
+
+- Handle connection strings (`Key=Value[;Key=Value...]`).
+
+```typescript
+import { createFactory } from '@shellicar/core-config';
+
+const factory = createFactory();
+const conn = factory.connectionString('Server=myserver;Password=myPassword123');
+console.log(conn.toString());
+// Server=myserver;Password=sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716
+
+// Custom secret keys
+console.log(factory.connectionString('Server=myserver;SuperSecretKey=myPassword123', ['SuperSecretKey']));
+// {
+//   Server: 'myserver',
+//   SuperSecretKey: 'sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716'
+// }
+```
+
+- Handle URLs with passwords.information:
+
+```typescript
+import { createFactory } from '@shellicar/core-config';
+
+const factory = createFactory();
+const url = new URL('https://user:myPassword123@example.com?key=value');
+const secureUrl = factory.url(url);
+
+console.log(secureUrl.toString());
+// https://user:sha256%3A71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716@example.com/?key=value
+
+console.log(secureUrl);
+// {
+//   href: 'https://user@example.com/',
+//   password: 'sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716',
+//   searchParams: { key: 'value' }
+// }
+```
+
+- Use HMAC.
+
+```ts
+import { createFactory } from '@shellicar/core-config';
+
+const factory = createFactory({ secret: 'mySecret' });
+const secret = factory.string('myPassword123');
+
+console.log(secret.toString()); 
+// sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716
+
+console.log(JSON.stringify({ secret }));
+// {"secret":"sha256:71d4ec024886c1c8e4707fb02b46fd568df44e77dd5055cadc3451747f0f2716"}
+```
+
+### Default Secure Keys
+
+For a list of default secure keys for connection strings, see [defaults.ts](./src/defaults.ts).
+
+### Secure Output
+
+All secure types implement proper toString(), toJSON(), and inspect() methods to ensure sensitive data is never accidentally exposed through logs or serialisation.
+
+### Real World Example
+
+Using with Zod for environment variable validation:
+
+```typescript
+import { env } from 'node:process';
+import { createFactory } from '@shellicar/core-config';
+import { z } from 'zod';
+
+const factory = createFactory();
+
+const envSchema = z.object({
+  // MongoDB connection string with username/password
+  MONGODB_URL: z.url().transform((x) => factory.url(new URL(x))),
+
+  // API key for external service
+  API_KEY: z
+    .string()
+    .min(1)
+    .transform((x) => factory.string(x)),
+
+  // SQL Server connection string
+  SQL_CONNECTION: z.string().transform((x) => factory.connectionString(x)),
+});
+
+// Parse environment variables
+const config = envSchema.parse(env);
+
+// Values are now strongly typed and secured
+console.log(config.MONGODB_URL.toString());
+// mongodb://myuser:sha256%3A...@mongodb.example.com/
+
+console.log(config.API_KEY.toString());
+// sha256:...
+
+console.log(config.SQL_CONNECTION.toString());
+// Server=myserver;Database=mydb;User Id=admin;Password=sha256:...
+```
 
-For full documentation, visit [here](https://github.com/shellicar/core-config).
+All sensitive values are automatically hashed in logs and serialisation, while still being accessible via the `secretValue` property when needed.

package/dist/cjs/EncryptedValue.cjs

@@ -1 +1,8 @@
-"use strict";var e=require("./chunk-FKX4J4Q2.cjs");require("./chunk-PK6SKIKE.cjs"),Object.defineProperty(exports,"EncryptedValue",{enumerable:!0,get:function(){return e.EncryptedValue}});//# sourceMappingURL=EncryptedValue.cjs.map
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkYK25AWXLcjs = require('./chunks/chunk-YK25AWXL.cjs');
+require('./chunks/chunk-X6BO6XFB.cjs');
+
+
+exports.EncryptedValue = _chunkYK25AWXLcjs.EncryptedValue;
+//# sourceMappingURL=EncryptedValue.cjs.map

package/dist/cjs/EncryptedValue.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"EncryptedValue.cjs"}
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/EncryptedValue.cjs"],"names":[],"mappings":"AAAA;AACE;AACF,+DAAoC;AACpC,uCAAoC;AACpC;AACE;AACF,0DAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/EncryptedValue.cjs"}

package/dist/cjs/SecureConnectionString.cjs

@@ -1 +1,11 @@
-"use strict";var e=require("./chunk-J7CRMQ5Z.cjs");require("./chunk-XVDIOMZD.cjs"),require("./chunk-JVM3GGW6.cjs"),require("./chunk-WZWXGAJN.cjs"),require("./chunk-PK6SKIKE.cjs"),Object.defineProperty(exports,"SecureConnectionString",{enumerable:!0,get:function(){return e.SecureConnectionString}});//# sourceMappingURL=SecureConnectionString.cjs.map
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkSRMLZGCXcjs = require('./chunks/chunk-SRMLZGCX.cjs');
+require('./chunks/chunk-BDMFGBTR.cjs');
+require('./chunks/chunk-PO2PS4VB.cjs');
+require('./chunks/chunk-GGWBGRR3.cjs');
+require('./chunks/chunk-X6BO6XFB.cjs');
+
+
+exports.SecureConnectionString = _chunkSRMLZGCXcjs.SecureConnectionString;
+//# sourceMappingURL=SecureConnectionString.cjs.map

package/dist/cjs/SecureConnectionString.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"SecureConnectionString.cjs"}
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/SecureConnectionString.cjs"],"names":[],"mappings":"AAAA;AACE;AACF,+DAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC;AACE;AACF,0EAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/SecureConnectionString.cjs"}

package/dist/cjs/SecureString.cjs

@@ -1 +1,10 @@
-"use strict";var e=require("./chunk-XVDIOMZD.cjs");require("./chunk-JVM3GGW6.cjs"),require("./chunk-WZWXGAJN.cjs"),require("./chunk-PK6SKIKE.cjs"),Object.defineProperty(exports,"SecureString",{enumerable:!0,get:function(){return e.SecureString}});//# sourceMappingURL=SecureString.cjs.map
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkBDMFGBTRcjs = require('./chunks/chunk-BDMFGBTR.cjs');
+require('./chunks/chunk-PO2PS4VB.cjs');
+require('./chunks/chunk-GGWBGRR3.cjs');
+require('./chunks/chunk-X6BO6XFB.cjs');
+
+
+exports.SecureString = _chunkBDMFGBTRcjs.SecureString;
+//# sourceMappingURL=SecureString.cjs.map

package/dist/cjs/SecureString.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"SecureString.cjs"}
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/SecureString.cjs"],"names":[],"mappings":"AAAA;AACE;AACF,+DAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC;AACE;AACF,sDAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/SecureString.cjs"}

package/dist/cjs/SecureURL.cjs

@@ -1 +1,11 @@
-"use strict";var e=require("./chunk-VQ2XCAJT.cjs");require("./chunk-XVDIOMZD.cjs"),require("./chunk-JVM3GGW6.cjs"),require("./chunk-WZWXGAJN.cjs"),require("./chunk-PK6SKIKE.cjs"),Object.defineProperty(exports,"SecureURL",{enumerable:!0,get:function(){return e.SecureURL}});//# sourceMappingURL=SecureURL.cjs.map
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkR4H4GKFWcjs = require('./chunks/chunk-R4H4GKFW.cjs');
+require('./chunks/chunk-BDMFGBTR.cjs');
+require('./chunks/chunk-PO2PS4VB.cjs');
+require('./chunks/chunk-GGWBGRR3.cjs');
+require('./chunks/chunk-X6BO6XFB.cjs');
+
+
+exports.SecureURL = _chunkR4H4GKFWcjs.SecureURL;
+//# sourceMappingURL=SecureURL.cjs.map

package/dist/cjs/SecureURL.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"SecureURL.cjs"}
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/SecureURL.cjs"],"names":[],"mappings":"AAAA;AACE;AACF,+DAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC,uCAAoC;AACpC;AACE;AACF,gDAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/SecureURL.cjs"}

package/dist/cjs/chunks/chunk-BDMFGBTR.cjs

@@ -0,0 +1,59 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var _chunkPO2PS4VBcjs = require('./chunk-PO2PS4VB.cjs');
+
+
+var _chunkGGWBGRR3cjs = require('./chunk-GGWBGRR3.cjs');
+
+
+var _chunkX6BO6XFBcjs = require('./chunk-X6BO6XFB.cjs');
+
+// src/SecureString.ts
+var _nodeutil = require('node:util'); var _nodeutil2 = _interopRequireDefault(_nodeutil);
+var SecureString = class _SecureString extends _chunkPO2PS4VBcjs.ISecureString {
+  static {
+    _chunkX6BO6XFBcjs.__name.call(void 0, this, "SecureString");
+  }
+  #encryptedValue;
+  #hash;
+  get secretValue() {
+    return this.#encryptedValue.getValue();
+  }
+  constructor(value, config) {
+    super();
+    this.#encryptedValue = config.encryptionProvider.encrypt(value);
+    this.#hash = _chunkGGWBGRR3cjs.hash.call(void 0, value, config.secret);
+  }
+  static factory(config) {
+    return (value) => _SecureString.from(value, config);
+  }
+  static from(value, config) {
+    if (value === null) {
+      return null;
+    }
+    if (value === void 0) {
+      return void 0;
+    }
+    return new _SecureString(value, config);
+  }
+  toString() {
+    return this.#hash;
+  }
+  toJSON() {
+    return this.toString();
+  }
+  [_nodeutil2.default.inspect.custom](depth, options, inspect) {
+    if (depth < 0) {
+      return "[SecureString]";
+    }
+    const newOptions = Object.assign({}, options, {
+      depth: options.depth == null ? null : options.depth - 1
+    });
+    return inspect(this.toJSON(), newOptions);
+  }
+};
+
+
+
+exports.SecureString = SecureString;
+//# sourceMappingURL=chunk-BDMFGBTR.cjs.map

package/dist/cjs/chunks/chunk-BDMFGBTR.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-BDMFGBTR.cjs","../../../src/SecureString.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACA;ACVA,yFAA0C;AAKnC,IAAM,aAAA,EAAN,MAAM,cAAA,QAAqB,gCAAc;AAAA,EALhD,OAKgD;AAAA,IAAA,sCAAA,IAAA,EAAA,cAAA,CAAA;AAAA,EAAA;AAAA,EACrC,CAAA,cAAA;AAAA,EACA,CAAA,IAAA;AAAA,EAET,IAAW,WAAA,CAAA,EAAsB;AAC/B,IAAA,OAAO,IAAA,CAAK,CAAA,cAAA,CAAgB,QAAA,CAAS,CAAA;AAAA,EACvC;AAAA,EAEQ,WAAA,CAAY,KAAA,EAAe,MAAA,EAAsB;AACvD,IAAA,KAAA,CAAM,CAAA;AACN,IAAA,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,kBAAA,CAAmB,OAAA,CAAQ,KAAK,CAAA;AAC9D,IAAA,IAAA,CAAK,CAAA,KAAA,EAAQ,oCAAA,KAAK,EAAO,MAAA,CAAO,MAAM,CAAA;AAAA,EACxC;AAAA,EAEA,OAAO,OAAA,CAAQ,MAAA,EAAuD;AACpE,IAAA,OAAO,CAAC,KAAA,EAAA,GAAkB,aAAA,CAAa,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA;AAAA,EAC3D;AAAA,EAEA,OAAc,IAAA,CAA0C,KAAA,EAAU,MAAA,EAA2D;AAC3H,IAAA,GAAA,CAAI,MAAA,IAAU,IAAA,EAAM;AAClB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,GAAA,CAAI,MAAA,IAAU,KAAA,CAAA,EAAW;AACvB,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAI,aAAA,CAAa,KAAA,EAAO,MAAM,CAAA;AAAA,EACvC;AAAA,EAEgB,QAAA,CAAA,EAAW;AACzB,IAAA,OAAO,IAAA,CAAK,CAAA,IAAA;AAAA,EACd;AAAA,EACgB,MAAA,CAAA,EAAS;AACvB,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,CAAA;AAAA,EACvB;AAAA,EACA,CAAU,kBAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,CAAE,KAAA,EAAe,OAAA,EAAyB,OAAA,EAAkC;AACvG,IAAA,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAG;AACb,MAAA,OAAO,gBAAA;AAAA,IACT;AACA,IAAA,MAAM,WAAA,EAAa,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,EAAG,OAAA,EAAS;AAAA,MAC5C,KAAA,EAAO,OAAA,CAAQ,MAAA,GAAS,KAAA,EAAO,KAAA,EAAO,OAAA,CAAQ,MAAA,EAAQ;AAAA,IACxD,CAAC,CAAA;AACD,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,CAAA,EAAG,UAAU,CAAA;AAAA,EAC1C;AACF,CAAA;ADMA;AACA;AACE;AACF,oCAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-BDMFGBTR.cjs","sourcesContent":[null,"import util, { type InspectOptions } from 'node:util';\nimport { hash } from './hash';\nimport { ISecureString } from './interfaces';\nimport type { IEncryptedValue, InspectFunction, SecureConfig } from './types';\n\nexport class SecureString extends ISecureString {\n  readonly #encryptedValue: IEncryptedValue;\n  readonly #hash: string;\n\n  public get secretValue(): string {\n    return this.#encryptedValue.getValue();\n  }\n\n  private constructor(value: string, config: SecureConfig) {\n    super();\n    this.#encryptedValue = config.encryptionProvider.encrypt(value);\n    this.#hash = hash(value, config.secret);\n  }\n\n  static factory(config: SecureConfig): (value: string) => SecureString {\n    return (value: string) => SecureString.from(value, config);\n  }\n\n  public static from<T extends string | null | undefined>(value: T, config: SecureConfig): T extends string ? SecureString : T {\n    if (value === null) {\n      return null as T extends string ? SecureString : T;\n    }\n    if (value === undefined) {\n      return undefined as T extends string ? SecureString : T;\n    }\n    return new SecureString(value, config) as T extends string ? SecureString : T;\n  }\n\n  public override toString() {\n    return this.#hash;\n  }\n  public override toJSON() {\n    return this.toString();\n  }\n  override [util.inspect.custom](depth: number, options: InspectOptions, inspect: InspectFunction): string {\n    if (depth < 0) {\n      return '[SecureString]';\n    }\n    const newOptions = Object.assign({}, options, {\n      depth: options.depth == null ? null : options.depth - 1,\n    });\n    return inspect(this.toJSON(), newOptions);\n  }\n}\n"]}

package/dist/cjs/chunks/chunk-FOL2TBBQ.cjs

@@ -0,0 +1,7 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/defaults.ts
+var defaultSecureKeys = ["AccessKey", "SharedAccessKey", "Password", "AccountKey", "Secret", "SecretKey", "ApiKey", "Token", "Key", "MasterKey", "PrimaryKey", "SecondaryKey"];
+
+
+
+exports.defaultSecureKeys = defaultSecureKeys;
+//# sourceMappingURL=chunk-FOL2TBBQ.cjs.map

package/dist/cjs/chunks/chunk-FOL2TBBQ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-FOL2TBBQ.cjs","../../../src/defaults.ts"],"names":[],"mappings":"AAAA;ACEO,IAAM,kBAAA,EAAoB,CAAC,WAAA,EAAa,iBAAA,EAAmB,UAAA,EAAY,YAAA,EAAc,QAAA,EAAU,WAAA,EAAa,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,WAAA,EAAa,YAAA,EAAc,cAAc,CAAA;ADAtL;AACA;AACE;AACF,8CAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-FOL2TBBQ.cjs","sourcesContent":[null,"import type { SecureKeys } from './types';\n\nexport const defaultSecureKeys = ['AccessKey', 'SharedAccessKey', 'Password', 'AccountKey', 'Secret', 'SecretKey', 'ApiKey', 'Token', 'Key', 'MasterKey', 'PrimaryKey', 'SecondaryKey'] as const satisfies SecureKeys;\n"]}

package/dist/cjs/chunks/chunk-GGWBGRR3.cjs

@@ -0,0 +1,29 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkX6BO6XFBcjs = require('./chunk-X6BO6XFB.cjs');
+
+// src/hash.ts
+var _nodecrypto = require('node:crypto');
+var algorithms = {
+  sha256: /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, () => ({
+    hash: /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (x) => _nodecrypto.createHash.call(void 0, "sha256").update(x).digest("hex"), "hash"),
+    prefix: "sha256"
+  }), "sha256"),
+  hs256: /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (secret) => ({
+    hash: /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (x) => _nodecrypto.createHmac.call(void 0, "sha256", secret).update(x).digest("hex"), "hash"),
+    prefix: "hs256"
+  }), "hs256")
+};
+var getAlgorithm = /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (secret) => {
+  return secret == null ? algorithms.sha256() : algorithms.hs256(secret);
+}, "getAlgorithm");
+var hash = /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (input, secret) => {
+  const alg = getAlgorithm(secret);
+  const hash2 = alg.hash(input);
+  return `${alg.prefix}:${hash2}`;
+}, "hash");
+
+
+
+exports.hash = hash;
+//# sourceMappingURL=chunk-GGWBGRR3.cjs.map

package/dist/cjs/chunks/chunk-GGWBGRR3.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-GGWBGRR3.cjs","../../../src/hash.ts"],"names":["hash"],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACA;ACJA,yCAAuC;AAOvC,IAAM,WAAA,EAAa;AAAA,EACjB,MAAA,kBAAQ,sCAAA,CAAA,EAAA,GAAA,CAAO;AAAA,IACb,IAAA,kBAAM,sCAAA,CAAC,CAAA,EAAA,GAAc,oCAAA,QAAmB,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,EAA1D,MAAA,CAAA;AAAA,IACN,MAAA,EAAQ;AAAA,EACV,CAAA,CAAA,EAHQ,QAAA,CAAA;AAAA,EAIR,KAAA,kBAAO,sCAAA,CAAC,MAAA,EAAA,GAAA,CAAoB;AAAA,IAC1B,IAAA,kBAAM,sCAAA,CAAC,CAAA,EAAA,GAAc,oCAAA,QAAW,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,EAAlE,MAAA,CAAA;AAAA,IACN,MAAA,EAAQ;AAAA,EACV,CAAA,CAAA,EAHO,OAAA;AAIT,CAAA;AAEA,IAAM,aAAA,kBAAe,sCAAA,CAAC,MAAA,EAAA,GAAyC;AAC7D,EAAA,OAAO,OAAA,GAAU,KAAA,EAAO,UAAA,CAAW,MAAA,CAAO,EAAA,EAAI,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA;AACvE,CAAA,EAFqB,cAAA,CAAA;AAId,IAAM,KAAA,kBAAO,sCAAA,CAAC,KAAA,EAAe,MAAA,EAAA,GAA0B;AAC5D,EAAA,MAAM,IAAA,EAAM,YAAA,CAAa,MAAM,CAAA;AAC/B,EAAA,MAAMA,MAAAA,EAAO,GAAA,CAAI,IAAA,CAAK,KAAK,CAAA;AAC3B,EAAA,OAAO,CAAA,EAAA;AAHW;ADEV;AACA;AACA;AACA","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-GGWBGRR3.cjs","sourcesContent":[null,"import { createHash, createHmac } from 'node:crypto';\n\ntype HashAlgorithm = {\n  hash: (x: string) => string;\n  prefix: string;\n};\n\nconst algorithms = {\n  sha256: () => ({\n    hash: (x: string) => createHash('sha256').update(x).digest('hex'),\n    prefix: 'sha256',\n  }),\n  hs256: (secret: string) => ({\n    hash: (x: string) => createHmac('sha256', secret).update(x).digest('hex'),\n    prefix: 'hs256',\n  }),\n} as const;\n\nconst getAlgorithm = (secret: string | null): HashAlgorithm => {\n  return secret == null ? algorithms.sha256() : algorithms.hs256(secret);\n};\n\nexport const hash = (input: string, secret: string | null) => {\n  const alg = getAlgorithm(secret);\n  const hash = alg.hash(input);\n  return `${alg.prefix}:${hash}`;\n};\n"]}

package/dist/cjs/chunks/chunk-K6RFKD55.cjs

@@ -0,0 +1,41 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkYK25AWXLcjs = require('./chunk-YK25AWXL.cjs');
+
+
+var _chunkSRMLZGCXcjs = require('./chunk-SRMLZGCX.cjs');
+
+
+var _chunkR4H4GKFWcjs = require('./chunk-R4H4GKFW.cjs');
+
+
+var _chunkBDMFGBTRcjs = require('./chunk-BDMFGBTR.cjs');
+
+
+var _chunkFOL2TBBQcjs = require('./chunk-FOL2TBBQ.cjs');
+
+
+var _chunkX6BO6XFBcjs = require('./chunk-X6BO6XFB.cjs');
+
+// src/createFactory.ts
+var defaultEncryptionProvider = {
+  encrypt: /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (value) => new (0, _chunkYK25AWXLcjs.EncryptedValue)(value), "encrypt")
+};
+var createFactory = /* @__PURE__ */ _chunkX6BO6XFBcjs.__name.call(void 0, (options) => {
+  const config = {
+    secret: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _ => _.secret]), () => ( null)),
+    encryptionProvider: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _2 => _2.encryptionProvider]), () => ( defaultEncryptionProvider)),
+    secretKeys: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _3 => _3.secretKeys]), () => ( _chunkFOL2TBBQcjs.defaultSecureKeys))
+  };
+  return {
+    string: _chunkBDMFGBTRcjs.SecureString.factory(config),
+    connectionString: _chunkSRMLZGCXcjs.SecureConnectionString.factory(config),
+    url: _chunkR4H4GKFWcjs.SecureURL.factory(config)
+  };
+}, "createFactory");
+
+
+
+
+exports.defaultEncryptionProvider = defaultEncryptionProvider; exports.createFactory = createFactory;
+//# sourceMappingURL=chunk-K6RFKD55.cjs.map

package/dist/cjs/chunks/chunk-K6RFKD55.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-K6RFKD55.cjs","../../../src/createFactory.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACA;ACXO,IAAM,0BAAA,EAAiD;AAAA,EAC5D,OAAA,kBAAS,sCAAA,CAAC,KAAA,EAAA,GAAkB,IAAI,qCAAA,CAAe,KAAK,CAAA,EAA3C,SAAA;AACX,CAAA;AAEO,IAAM,cAAA,kBAAgB,sCAAA,CAAC,OAAA,EAAA,GAAoD;AAChF,EAAA,MAAM,OAAA,EAAuB;AAAA,IAC3B,MAAA,mCAAQ,OAAA,2BAAS,QAAA,UAAU,MAAA;AAAA,IAC3B,kBAAA,mCAAoB,OAAA,6BAAS,oBAAA,UAAsB,2BAAA;AAAA,IACnD,UAAA,mCAAY,OAAA,6BAAS,YAAA,UAAc;AAAA,EACrC,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,8BAAA,CAAa,OAAA,CAAQ,MAAM,CAAA;AAAA,IACnC,gBAAA,EAAkB,wCAAA,CAAuB,OAAA,CAAQ,MAAM,CAAA;AAAA,IACvD,GAAA,EAAK,2BAAA,CAAU,OAAA,CAAQ,MAAM;AAAA,EAC/B,CAAA;AACF,CAAA,EAZ6B,eAAA,CAAA;ADuB7B;AACA;AACE;AACA;AACF,qGAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-K6RFKD55.cjs","sourcesContent":[null,"import { defaultSecureKeys } from './defaults';\nimport { EncryptedValue } from './EncryptedValue';\nimport type { ISecureFactory } from './interfaces';\nimport { SecureConnectionString } from './SecureConnectionString';\nimport { SecureString } from './SecureString';\nimport { SecureURL } from './SecureURL';\nimport type { IEncryptionProvider, SecureConfig } from './types';\n\nexport const defaultEncryptionProvider: IEncryptionProvider = {\n  encrypt: (value: string) => new EncryptedValue(value),\n};\n\nexport const createFactory = (options?: Partial<SecureConfig>): ISecureFactory => {\n  const config: SecureConfig = {\n    secret: options?.secret ?? null,\n    encryptionProvider: options?.encryptionProvider ?? defaultEncryptionProvider,\n    secretKeys: options?.secretKeys ?? defaultSecureKeys,\n  };\n\n  return {\n    string: SecureString.factory(config),\n    connectionString: SecureConnectionString.factory(config),\n    url: SecureURL.factory(config),\n  };\n};\n"]}

package/dist/cjs/chunks/chunk-PO2PS4VB.cjs

@@ -0,0 +1,34 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkX6BO6XFBcjs = require('./chunk-X6BO6XFB.cjs');
+
+// src/interfaces.ts
+require('node:util');
+var ISecureString = class {
+  static {
+    _chunkX6BO6XFBcjs.__name.call(void 0, this, "ISecureString");
+  }
+};
+var ISecureConnectionString = class {
+  static {
+    _chunkX6BO6XFBcjs.__name.call(void 0, this, "ISecureConnectionString");
+  }
+};
+var ISecureURL = class {
+  static {
+    _chunkX6BO6XFBcjs.__name.call(void 0, this, "ISecureURL");
+  }
+};
+var ISecureFactory = class {
+  static {
+    _chunkX6BO6XFBcjs.__name.call(void 0, this, "ISecureFactory");
+  }
+};
+
+
+
+
+
+
+exports.ISecureString = ISecureString; exports.ISecureConnectionString = ISecureConnectionString; exports.ISecureURL = ISecureURL; exports.ISecureFactory = ISecureFactory;
+//# sourceMappingURL=chunk-PO2PS4VB.cjs.map

package/dist/cjs/chunks/chunk-PO2PS4VB.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-PO2PS4VB.cjs","../../../src/interfaces.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACA;ACJA,qBAA0C;AAGnC,IAAe,cAAA,EAAf,MAAmD;AAAA,EAH1D,OAG0D;AAAA,IAAA,sCAAA,IAAA,EAAA,eAAA,CAAA;AAAA,EAAA;AAK1D,CAAA;AAEO,IAAe,wBAAA,EAAf,MAA6D;AAAA,EAVpE,OAUoE;AAAA,IAAA,sCAAA,IAAA,EAAA,yBAAA,CAAA;AAAA,EAAA;AAKpE,CAAA;AAEO,IAAe,WAAA,EAAf,MAAgD;AAAA,EAjBvD,OAiBuD;AAAA,IAAA,sCAAA,IAAA,EAAA,YAAA,CAAA;AAAA,EAAA;AAKvD,CAAA;AAEO,IAAe,eAAA,EAAf,MAA8B;AAAA,EAxBrC,OAwBqC;AAAA,IAAA,sCAAA,IAAA,EAAA,gBAAA,CAAA;AAAA,EAAA;AAIrC,CAAA;ADFA;AACA;AACE;AACA;AACA;AACA;AACF,2KAAC","file":"/home/runner/work/ecosystem/ecosystem/packages/core-config/dist/cjs/chunks/chunk-PO2PS4VB.cjs","sourcesContent":[null,"import util, { type InspectOptions } from 'node:util';\nimport type { BaseObject, InspectFunction } from './types';\n\nexport abstract class ISecureString implements BaseObject {\n  public abstract toString(): string;\n  public abstract toJSON(): string | object;\n  public abstract [util.inspect.custom](depth: number, options: InspectOptions, inspect: InspectFunction): string;\n  public abstract get secretValue(): string;\n}\n\nexport abstract class ISecureConnectionString implements BaseObject {\n  public abstract toString(): string;\n  public abstract toJSON(): string | object;\n  public abstract [util.inspect.custom](depth: number, options: InspectOptions, inspect: InspectFunction): string;\n  public abstract get secretValue(): string;\n}\n\nexport abstract class ISecureURL implements BaseObject {\n  public abstract toString(): string;\n  public abstract toJSON(): object;\n  public abstract [util.inspect.custom](depth: number, options: InspectOptions, inspect: InspectFunction): string;\n  public abstract get secretValue(): URL;\n}\n\nexport abstract class ISecureFactory {\n  public abstract string(value: string): ISecureString;\n  public abstract connectionString(value: string, secretKeys?: readonly string[]): ISecureConnectionString;\n  public abstract url(value: URL): ISecureURL;\n}\n"]}

package/dist/cjs/chunks/chunk-R4H4GKFW.cjs

@@ -0,0 +1,82 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var _chunkBDMFGBTRcjs = require('./chunk-BDMFGBTR.cjs');
+
+
+var _chunkPO2PS4VBcjs = require('./chunk-PO2PS4VB.cjs');
+
+
+var _chunkX6BO6XFBcjs = require('./chunk-X6BO6XFB.cjs');
+
+// src/SecureURL.ts
+var _nodeutil = require('node:util'); var _nodeutil2 = _interopRequireDefault(_nodeutil);
+var SecureURL = class _SecureURL extends _chunkPO2PS4VBcjs.ISecureURL {
+  static {
+    _chunkX6BO6XFBcjs.__name.call(void 0, this, "SecureURL");
+  }
+  #encryptedValue;
+  #password;
+  get secretValue() {
+    return new URL(this.#encryptedValue.getValue());
+  }
+  constructor(value, config) {
+    super();
+    this.#encryptedValue = config.encryptionProvider.encrypt(value.href);
+    this.#password = _chunkBDMFGBTRcjs.SecureString.from(value.password || null, config);
+  }
+  static factory(config) {
+    return (value) => _SecureURL.from(value, config);
+  }
+  static from(value, config) {
+    if (value === null) {
+      return null;
+    }
+    if (value === void 0) {
+      return void 0;
+    }
+    return new _SecureURL(value, config);
+  }
+  toString() {
+    const originalUrl = this.secretValue;
+    const newUrl = new URL(originalUrl.href);
+    if (this.#password !== null) {
+      newUrl.password = this.#password.toString();
+    }
+    return newUrl.href;
+  }
+  toJSON() {
+    const originalUrl = this.secretValue;
+    const newUrl = new URL(originalUrl.href);
+    newUrl.password = "";
+    const searchParams = new URLSearchParams(newUrl.searchParams);
+    newUrl.search = "";
+    let password;
+    if (this.#password !== null) {
+      password = this.#password.toString();
+    }
+    const result = {
+      href: newUrl.href
+    };
+    if (password !== void 0) {
+      result.password = password;
+    }
+    if (searchParams.size > 0) {
+      result.searchParams = Object.fromEntries(searchParams);
+    }
+    return result;
+  }
+  [_nodeutil2.default.inspect.custom](depth, options, inspect) {
+    if (depth < 0) {
+      return "[SecureURL]";
+    }
+    const newOptions = Object.assign({}, options, {
+      depth: options.depth == null ? null : options.depth - 1
+    });
+    return inspect(this.toJSON(), newOptions);
+  }
+};
+
+
+
+exports.SecureURL = SecureURL;
+//# sourceMappingURL=chunk-R4H4GKFW.cjs.map