@shipfox/api-secrets 15.0.0 → 17.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 53 files with swc (402.24ms)
+Successfully compiled: 53 files with swc (319.1ms)

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @shipfox/api-secrets
 
+## 17.0.0
+
+### Patch Changes
+
+- 9f898d9: Persists encrypted agent session transcripts to object storage, adds a retention sweep that deletes expired sessions, and adds KEK rotation for envelope-encrypted artifacts. Deployments must set `AGENT_SESSION_ENCRYPTION_KEK` to a unique base64-encoded 32-byte key before upgrading.
+- Updated dependencies [a4f56ff]
+- Updated dependencies [a591e8a]
+- Updated dependencies [9f898d9]
+- Updated dependencies [9f898d9]
+  - @shipfox/api-auth-context@17.0.0
+  - @shipfox/node-postgres@0.5.1
+  - @shipfox/node-envelope-encryption@0.2.0
+  - @shipfox/node-outbox@0.2.6
+
 ## 15.0.0
 
 ### Patch Changes

package/README.md

@@ -135,6 +135,8 @@ Secret management routes should keep secret values write-only at the HTTP bounda
 
 Secret values use envelope encryption.
 
+`@shipfox/node-envelope-encryption` owns the shared cipher, key-provider, cache, and rotation mechanics. This module owns its KEK configuration, AAD, tables, metrics, and domain errors.
+
 - Each workspace has one 32-byte data-encryption key (DEK).
 - The DEK is generated with `crypto.randomBytes(32)` on first use.
 - The DEK is wrapped with the configured key-encryption key (KEK) and stored in `secrets_data_keys`.

package/dist/config.js

@@ -4,7 +4,7 @@ import { decodeBase64Key } from '#core/crypto.js';
 export const MAX_VALUE_BYTES = 64 * 1024;
 export const config = createConfig({
     SECRETS_ENCRYPTION_KEK: str({
-        desc: 'Master key used to protect all stored secrets. Required. Generate a unique value per environment with openssl rand -base64 32 and provide it from a secret manager. The committed .env value is only for local development. Losing this key makes stored secrets unrecoverable. To rotate it, set SECRETS_ENCRYPTION_KEK_PREVIOUS to the old value during the rotation window.'
+        desc: 'Master key used to protect all stored secrets. Required. Generate a unique value per environment with openssl rand -base64 32 and provide it from a secret manager. Do not reuse AGENT_SESSION_ENCRYPTION_KEK. The committed .env value is only for local development. Losing this key makes stored secrets unrecoverable. To rotate it, set SECRETS_ENCRYPTION_KEK_PREVIOUS to the old value during the rotation window.'
     }),
     SECRETS_ENCRYPTION_KEK_PREVIOUS: str({
         desc: 'Previous master key used only while rotating stored secret data keys. Optional. Set it to the old SECRETS_ENCRYPTION_KEK value until rotation has completed.',

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {SECRETS_MAX_LIST_LIMIT} from '@shipfox/api-secrets-dto';\nimport {createConfig, num, str} from '@shipfox/config';\nimport {decodeBase64Key} from '#core/crypto.js';\n\nexport const MAX_VALUE_BYTES = 64 * 1024;\n\nexport const config = createConfig({\n  SECRETS_ENCRYPTION_KEK: str({\n    desc: 'Master key used to protect all stored secrets. Required. Generate a unique value per environment with openssl rand -base64 32 and provide it from a secret manager. The committed .env value is only for local development. Losing this key makes stored secrets unrecoverable. To rotate it, set SECRETS_ENCRYPTION_KEK_PREVIOUS to the old value during the rotation window.',\n  }),\n  SECRETS_ENCRYPTION_KEK_PREVIOUS: str({\n    desc: 'Previous master key used only while rotating stored secret data keys. Optional. Set it to the old SECRETS_ENCRYPTION_KEK value until rotation has completed.',\n    default: undefined,\n  }),\n  SECRETS_MAX_PER_WORKSPACE: num({\n    desc: 'Maximum number of secrets and variables allowed per workspace across all project scopes and namespaces.',\n    default: 10000,\n  }),\n  SECRETS_SHORT_VALUE_WARN_LENGTH: num({\n    desc: 'Secret values shorter than this many characters are classified for a write warning by management routes.',\n    default: 12,\n  }),\n});\n\ndecodeBase64Key(config.SECRETS_ENCRYPTION_KEK, 'SECRETS_ENCRYPTION_KEK');\nif (config.SECRETS_ENCRYPTION_KEK_PREVIOUS) {\n  decodeBase64Key(config.SECRETS_ENCRYPTION_KEK_PREVIOUS, 'SECRETS_ENCRYPTION_KEK_PREVIOUS');\n}\nif (config.SECRETS_MAX_PER_WORKSPACE < 1) {\n  throw new Error('SECRETS_MAX_PER_WORKSPACE must be greater than 0.');\n}\nif (config.SECRETS_MAX_PER_WORKSPACE > SECRETS_MAX_LIST_LIMIT) {\n  // The settings UI lists the whole bounded set in one call (limit = SECRETS_MAX_LIST_LIMIT).\n  // A cap above that would let the list silently truncate, so fail fast instead.\n  throw new Error(\n    `SECRETS_MAX_PER_WORKSPACE (${config.SECRETS_MAX_PER_WORKSPACE}) cannot exceed SECRETS_MAX_LIST_LIMIT (${SECRETS_MAX_LIST_LIMIT}).`,\n  );\n}\nif (config.SECRETS_SHORT_VALUE_WARN_LENGTH < 1) {\n  throw new Error('SECRETS_SHORT_VALUE_WARN_LENGTH must be greater than 0.');\n}\n"],"names":["SECRETS_MAX_LIST_LIMIT","createConfig","num","str","decodeBase64Key","MAX_VALUE_BYTES","config","SECRETS_ENCRYPTION_KEK","desc","SECRETS_ENCRYPTION_KEK_PREVIOUS","default","undefined","SECRETS_MAX_PER_WORKSPACE","SECRETS_SHORT_VALUE_WARN_LENGTH","Error"],"mappings":"AAAA,SAAQA,sBAAsB,QAAO,2BAA2B;AAChE,SAAQC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AACvD,SAAQC,eAAe,QAAO,kBAAkB;AAEhD,OAAO,MAAMC,kBAAkB,KAAK,KAAK;AAEzC,OAAO,MAAMC,SAASL,aAAa;IACjCM,wBAAwBJ,IAAI;QAC1BK,MAAM;IACR;IACAC,iCAAiCN,IAAI;QACnCK,MAAM;QACNE,SAASC;IACX;IACAC,2BAA2BV,IAAI;QAC7BM,MAAM;QACNE,SAAS;IACX;IACAG,iCAAiCX,IAAI;QACnCM,MAAM;QACNE,SAAS;IACX;AACF,GAAG;AAEHN,gBAAgBE,OAAOC,sBAAsB,EAAE;AAC/C,IAAID,OAAOG,+BAA+B,EAAE;IAC1CL,gBAAgBE,OAAOG,+BAA+B,EAAE;AAC1D;AACA,IAAIH,OAAOM,yBAAyB,GAAG,GAAG;IACxC,MAAM,IAAIE,MAAM;AAClB;AACA,IAAIR,OAAOM,yBAAyB,GAAGZ,wBAAwB;IAC7D,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,IAAIc,MACR,CAAC,2BAA2B,EAAER,OAAOM,yBAAyB,CAAC,wCAAwC,EAAEZ,uBAAuB,EAAE,CAAC;AAEvI;AACA,IAAIM,OAAOO,+BAA+B,GAAG,GAAG;IAC9C,MAAM,IAAIC,MAAM;AAClB"}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {SECRETS_MAX_LIST_LIMIT} from '@shipfox/api-secrets-dto';\nimport {createConfig, num, str} from '@shipfox/config';\nimport {decodeBase64Key} from '#core/crypto.js';\n\nexport const MAX_VALUE_BYTES = 64 * 1024;\n\nexport const config = createConfig({\n  SECRETS_ENCRYPTION_KEK: str({\n    desc: 'Master key used to protect all stored secrets. Required. Generate a unique value per environment with openssl rand -base64 32 and provide it from a secret manager. Do not reuse AGENT_SESSION_ENCRYPTION_KEK. The committed .env value is only for local development. Losing this key makes stored secrets unrecoverable. To rotate it, set SECRETS_ENCRYPTION_KEK_PREVIOUS to the old value during the rotation window.',\n  }),\n  SECRETS_ENCRYPTION_KEK_PREVIOUS: str({\n    desc: 'Previous master key used only while rotating stored secret data keys. Optional. Set it to the old SECRETS_ENCRYPTION_KEK value until rotation has completed.',\n    default: undefined,\n  }),\n  SECRETS_MAX_PER_WORKSPACE: num({\n    desc: 'Maximum number of secrets and variables allowed per workspace across all project scopes and namespaces.',\n    default: 10000,\n  }),\n  SECRETS_SHORT_VALUE_WARN_LENGTH: num({\n    desc: 'Secret values shorter than this many characters are classified for a write warning by management routes.',\n    default: 12,\n  }),\n});\n\ndecodeBase64Key(config.SECRETS_ENCRYPTION_KEK, 'SECRETS_ENCRYPTION_KEK');\nif (config.SECRETS_ENCRYPTION_KEK_PREVIOUS) {\n  decodeBase64Key(config.SECRETS_ENCRYPTION_KEK_PREVIOUS, 'SECRETS_ENCRYPTION_KEK_PREVIOUS');\n}\nif (config.SECRETS_MAX_PER_WORKSPACE < 1) {\n  throw new Error('SECRETS_MAX_PER_WORKSPACE must be greater than 0.');\n}\nif (config.SECRETS_MAX_PER_WORKSPACE > SECRETS_MAX_LIST_LIMIT) {\n  // The settings UI lists the whole bounded set in one call (limit = SECRETS_MAX_LIST_LIMIT).\n  // A cap above that would let the list silently truncate, so fail fast instead.\n  throw new Error(\n    `SECRETS_MAX_PER_WORKSPACE (${config.SECRETS_MAX_PER_WORKSPACE}) cannot exceed SECRETS_MAX_LIST_LIMIT (${SECRETS_MAX_LIST_LIMIT}).`,\n  );\n}\nif (config.SECRETS_SHORT_VALUE_WARN_LENGTH < 1) {\n  throw new Error('SECRETS_SHORT_VALUE_WARN_LENGTH must be greater than 0.');\n}\n"],"names":["SECRETS_MAX_LIST_LIMIT","createConfig","num","str","decodeBase64Key","MAX_VALUE_BYTES","config","SECRETS_ENCRYPTION_KEK","desc","SECRETS_ENCRYPTION_KEK_PREVIOUS","default","undefined","SECRETS_MAX_PER_WORKSPACE","SECRETS_SHORT_VALUE_WARN_LENGTH","Error"],"mappings":"AAAA,SAAQA,sBAAsB,QAAO,2BAA2B;AAChE,SAAQC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AACvD,SAAQC,eAAe,QAAO,kBAAkB;AAEhD,OAAO,MAAMC,kBAAkB,KAAK,KAAK;AAEzC,OAAO,MAAMC,SAASL,aAAa;IACjCM,wBAAwBJ,IAAI;QAC1BK,MAAM;IACR;IACAC,iCAAiCN,IAAI;QACnCK,MAAM;QACNE,SAASC;IACX;IACAC,2BAA2BV,IAAI;QAC7BM,MAAM;QACNE,SAAS;IACX;IACAG,iCAAiCX,IAAI;QACnCM,MAAM;QACNE,SAAS;IACX;AACF,GAAG;AAEHN,gBAAgBE,OAAOC,sBAAsB,EAAE;AAC/C,IAAID,OAAOG,+BAA+B,EAAE;IAC1CL,gBAAgBE,OAAOG,+BAA+B,EAAE;AAC1D;AACA,IAAIH,OAAOM,yBAAyB,GAAG,GAAG;IACxC,MAAM,IAAIE,MAAM;AAClB;AACA,IAAIR,OAAOM,yBAAyB,GAAGZ,wBAAwB;IAC7D,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,IAAIc,MACR,CAAC,2BAA2B,EAAER,OAAOM,yBAAyB,CAAC,wCAAwC,EAAEZ,uBAAuB,EAAE,CAAC;AAEvI;AACA,IAAIM,OAAOO,+BAA+B,GAAG,GAAG;IAC9C,MAAM,IAAIC,MAAM;AAClB"}

package/dist/core/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAS3D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CA4B3D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAelF;AAED,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAIhE"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAM3D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlF;AAED,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAIhE"}

package/dist/core/crypto.js

@@ -1,61 +1,22 @@
-import crypto from 'node:crypto';
+import { decodeBase64Key as decodeEnvelopeKey, KeyConfigurationError, openEnvelopeText, sealEnvelopeText } from '@shipfox/node-envelope-encryption';
 import { KekConfigurationError, SecretDecryptionError } from './errors.js';
-const CIPHER = 'aes-256-gcm';
-const ENCODED_PREFIX = 'v1:';
-const IV_BYTES = 12;
-const AUTH_TAG_BYTES = 16;
-const KEY_BYTES = 32;
-const BASE64_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;
-const BASE64_PADDING_SUFFIX = /=+$/;
 export function aesGcmSeal(params) {
-    const iv = crypto.randomBytes(IV_BYTES);
-    const cipher = crypto.createCipheriv(CIPHER, params.key, iv);
-    cipher.setAAD(Buffer.from(params.aad, 'utf8'));
-    const ciphertext = Buffer.concat([
-        cipher.update(params.plaintext),
-        cipher.final()
-    ]);
-    const authTag = cipher.getAuthTag();
-    return `${ENCODED_PREFIX}${Buffer.concat([
-        iv,
-        authTag,
-        ciphertext
-    ]).toString('base64')}`;
+    return sealEnvelopeText(params);
 }
 export function aesGcmOpen(params) {
-    if (!params.encoded.startsWith(ENCODED_PREFIX)) throw new SecretDecryptionError();
-    const encodedPayload = params.encoded.slice(ENCODED_PREFIX.length);
-    const payload = Buffer.from(encodedPayload, 'base64');
-    const canonical = payload.toString('base64');
-    if (!BASE64_KEY_PATTERN.test(encodedPayload) || canonical.replace(BASE64_PADDING_SUFFIX, '') !== encodedPayload.replace(BASE64_PADDING_SUFFIX, '')) {
-        throw new SecretDecryptionError();
-    }
-    if (payload.length < IV_BYTES + AUTH_TAG_BYTES) throw new SecretDecryptionError();
     try {
-        const iv = payload.subarray(0, IV_BYTES);
-        const authTag = payload.subarray(IV_BYTES, IV_BYTES + AUTH_TAG_BYTES);
-        const ciphertext = payload.subarray(IV_BYTES + AUTH_TAG_BYTES);
-        const decipher = crypto.createDecipheriv(CIPHER, params.key, iv);
-        decipher.setAAD(Buffer.from(params.aad, 'utf8'));
-        decipher.setAuthTag(authTag);
-        return Buffer.concat([
-            decipher.update(ciphertext),
-            decipher.final()
-        ]);
-    } catch (error) {
-        if (error instanceof SecretDecryptionError) throw error;
+        return openEnvelopeText(params);
+    } catch  {
         throw new SecretDecryptionError();
     }
 }
 export function decodeBase64Key(encoded, label) {
-    if (!encoded) {
-        throw new KekConfigurationError(`${label} is required and must be a base64-encoded 32-byte key. Generate one with openssl rand -base64 32.`);
-    }
-    const key = Buffer.from(encoded, 'base64');
-    if (key.length !== KEY_BYTES || !isCanonicalBase64Key(encoded, key)) {
-        throw new KekConfigurationError(`${label} must be a canonical base64-encoded 32-byte key. Strip whitespace and generate a new value with openssl rand -base64 32 if needed.`);
+    try {
+        return decodeEnvelopeKey(encoded, label);
+    } catch (error) {
+        if (error instanceof KeyConfigurationError) throw new KekConfigurationError(error.message);
+        throw error;
     }
-    return key;
 }
 export function aadForDek(workspaceId, kekVersion) {
     return JSON.stringify([
@@ -78,8 +39,5 @@ export function aadForValue(params) {
         params.key
     ]);
 }
-function isCanonicalBase64Key(encoded, key) {
-    return BASE64_KEY_PATTERN.test(encoded) && key.toString('base64') === encoded;
-}
 
 //# sourceMappingURL=crypto.js.map

package/dist/core/crypto.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/crypto.ts"],"sourcesContent":["import crypto from 'node:crypto';\nimport {KekConfigurationError, SecretDecryptionError} from './errors.js';\n\nconst CIPHER = 'aes-256-gcm';\nconst ENCODED_PREFIX = 'v1:';\nconst IV_BYTES = 12;\nconst AUTH_TAG_BYTES = 16;\nconst KEY_BYTES = 32;\nconst BASE64_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;\nconst BASE64_PADDING_SUFFIX = /=+$/;\n\nexport interface AesGcmSealParams {\n  key: Buffer;\n  plaintext: Buffer;\n  aad: string;\n}\n\nexport interface AesGcmOpenParams {\n  key: Buffer;\n  encoded: string;\n  aad: string;\n}\n\nexport interface SecretScope {\n  projectId?: string | null | undefined;\n}\n\nexport interface SecretValueAadParams {\n  workspaceId: string;\n  scope?: SecretScope | undefined;\n  namespace: string;\n  key: string;\n}\n\nexport function aesGcmSeal(params: AesGcmSealParams): string {\n  const iv = crypto.randomBytes(IV_BYTES);\n  const cipher = crypto.createCipheriv(CIPHER, params.key, iv);\n  cipher.setAAD(Buffer.from(params.aad, 'utf8'));\n\n  const ciphertext = Buffer.concat([cipher.update(params.plaintext), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n\n  return `${ENCODED_PREFIX}${Buffer.concat([iv, authTag, ciphertext]).toString('base64')}`;\n}\n\nexport function aesGcmOpen(params: AesGcmOpenParams): Buffer {\n  if (!params.encoded.startsWith(ENCODED_PREFIX)) throw new SecretDecryptionError();\n\n  const encodedPayload = params.encoded.slice(ENCODED_PREFIX.length);\n  const payload = Buffer.from(encodedPayload, 'base64');\n  const canonical = payload.toString('base64');\n  if (\n    !BASE64_KEY_PATTERN.test(encodedPayload) ||\n    canonical.replace(BASE64_PADDING_SUFFIX, '') !==\n      encodedPayload.replace(BASE64_PADDING_SUFFIX, '')\n  ) {\n    throw new SecretDecryptionError();\n  }\n  if (payload.length < IV_BYTES + AUTH_TAG_BYTES) throw new SecretDecryptionError();\n\n  try {\n    const iv = payload.subarray(0, IV_BYTES);\n    const authTag = payload.subarray(IV_BYTES, IV_BYTES + AUTH_TAG_BYTES);\n    const ciphertext = payload.subarray(IV_BYTES + AUTH_TAG_BYTES);\n    const decipher = crypto.createDecipheriv(CIPHER, params.key, iv);\n    decipher.setAAD(Buffer.from(params.aad, 'utf8'));\n    decipher.setAuthTag(authTag);\n\n    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n  } catch (error) {\n    if (error instanceof SecretDecryptionError) throw error;\n    throw new SecretDecryptionError();\n  }\n}\n\nexport function decodeBase64Key(encoded: string | undefined, label: string): Buffer {\n  if (!encoded) {\n    throw new KekConfigurationError(\n      `${label} is required and must be a base64-encoded 32-byte key. Generate one with openssl rand -base64 32.`,\n    );\n  }\n\n  const key = Buffer.from(encoded, 'base64');\n  if (key.length !== KEY_BYTES || !isCanonicalBase64Key(encoded, key)) {\n    throw new KekConfigurationError(\n      `${label} must be a canonical base64-encoded 32-byte key. Strip whitespace and generate a new value with openssl rand -base64 32 if needed.`,\n    );\n  }\n\n  return key;\n}\n\nexport function aadForDek(workspaceId: string, kekVersion: string): string {\n  return JSON.stringify([workspaceId, kekVersion]);\n}\n\nexport function aadForValue(params: SecretValueAadParams): string {\n  const projectId = params.scope?.projectId ?? null;\n  const scopeTuple = projectId !== null ? ['project', projectId] : ['workspace'];\n  return JSON.stringify([params.workspaceId, scopeTuple, params.namespace, params.key]);\n}\n\nfunction isCanonicalBase64Key(encoded: string, key: Buffer): boolean {\n  return BASE64_KEY_PATTERN.test(encoded) && key.toString('base64') === encoded;\n}\n"],"names":["crypto","KekConfigurationError","SecretDecryptionError","CIPHER","ENCODED_PREFIX","IV_BYTES","AUTH_TAG_BYTES","KEY_BYTES","BASE64_KEY_PATTERN","BASE64_PADDING_SUFFIX","aesGcmSeal","params","iv","randomBytes","cipher","createCipheriv","key","setAAD","Buffer","from","aad","ciphertext","concat","update","plaintext","final","authTag","getAuthTag","toString","aesGcmOpen","encoded","startsWith","encodedPayload","slice","length","payload","canonical","test","replace","subarray","decipher","createDecipheriv","setAuthTag","error","decodeBase64Key","label","isCanonicalBase64Key","aadForDek","workspaceId","kekVersion","JSON","stringify","aadForValue","projectId","scope","scopeTuple","namespace"],"mappings":"AAAA,OAAOA,YAAY,cAAc;AACjC,SAAQC,qBAAqB,EAAEC,qBAAqB,QAAO,cAAc;AAEzE,MAAMC,SAAS;AACf,MAAMC,iBAAiB;AACvB,MAAMC,WAAW;AACjB,MAAMC,iBAAiB;AACvB,MAAMC,YAAY;AAClB,MAAMC,qBAAqB;AAC3B,MAAMC,wBAAwB;AAyB9B,OAAO,SAASC,WAAWC,MAAwB;IACjD,MAAMC,KAAKZ,OAAOa,WAAW,CAACR;IAC9B,MAAMS,SAASd,OAAOe,cAAc,CAACZ,QAAQQ,OAAOK,GAAG,EAAEJ;IACzDE,OAAOG,MAAM,CAACC,OAAOC,IAAI,CAACR,OAAOS,GAAG,EAAE;IAEtC,MAAMC,aAAaH,OAAOI,MAAM,CAAC;QAACR,OAAOS,MAAM,CAACZ,OAAOa,SAAS;QAAGV,OAAOW,KAAK;KAAG;IAClF,MAAMC,UAAUZ,OAAOa,UAAU;IAEjC,OAAO,GAAGvB,iBAAiBc,OAAOI,MAAM,CAAC;QAACV;QAAIc;QAASL;KAAW,EAAEO,QAAQ,CAAC,WAAW;AAC1F;AAEA,OAAO,SAASC,WAAWlB,MAAwB;IACjD,IAAI,CAACA,OAAOmB,OAAO,CAACC,UAAU,CAAC3B,iBAAiB,MAAM,IAAIF;IAE1D,MAAM8B,iBAAiBrB,OAAOmB,OAAO,CAACG,KAAK,CAAC7B,eAAe8B,MAAM;IACjE,MAAMC,UAAUjB,OAAOC,IAAI,CAACa,gBAAgB;IAC5C,MAAMI,YAAYD,QAAQP,QAAQ,CAAC;IACnC,IACE,CAACpB,mBAAmB6B,IAAI,CAACL,mBACzBI,UAAUE,OAAO,CAAC7B,uBAAuB,QACvCuB,eAAeM,OAAO,CAAC7B,uBAAuB,KAChD;QACA,MAAM,IAAIP;IACZ;IACA,IAAIiC,QAAQD,MAAM,GAAG7B,WAAWC,gBAAgB,MAAM,IAAIJ;IAE1D,IAAI;QACF,MAAMU,KAAKuB,QAAQI,QAAQ,CAAC,GAAGlC;QAC/B,MAAMqB,UAAUS,QAAQI,QAAQ,CAAClC,UAAUA,WAAWC;QACtD,MAAMe,aAAac,QAAQI,QAAQ,CAAClC,WAAWC;QAC/C,MAAMkC,WAAWxC,OAAOyC,gBAAgB,CAACtC,QAAQQ,OAAOK,GAAG,EAAEJ;QAC7D4B,SAASvB,MAAM,CAACC,OAAOC,IAAI,CAACR,OAAOS,GAAG,EAAE;QACxCoB,SAASE,UAAU,CAAChB;QAEpB,OAAOR,OAAOI,MAAM,CAAC;YAACkB,SAASjB,MAAM,CAACF;YAAamB,SAASf,KAAK;SAAG;IACtE,EAAE,OAAOkB,OAAO;QACd,IAAIA,iBAAiBzC,uBAAuB,MAAMyC;QAClD,MAAM,IAAIzC;IACZ;AACF;AAEA,OAAO,SAAS0C,gBAAgBd,OAA2B,EAAEe,KAAa;IACxE,IAAI,CAACf,SAAS;QACZ,MAAM,IAAI7B,sBACR,GAAG4C,MAAM,iGAAiG,CAAC;IAE/G;IAEA,MAAM7B,MAAME,OAAOC,IAAI,CAACW,SAAS;IACjC,IAAId,IAAIkB,MAAM,KAAK3B,aAAa,CAACuC,qBAAqBhB,SAASd,MAAM;QACnE,MAAM,IAAIf,sBACR,GAAG4C,MAAM,kIAAkI,CAAC;IAEhJ;IAEA,OAAO7B;AACT;AAEA,OAAO,SAAS+B,UAAUC,WAAmB,EAAEC,UAAkB;IAC/D,OAAOC,KAAKC,SAAS,CAAC;QAACH;QAAaC;KAAW;AACjD;AAEA,OAAO,SAASG,YAAYzC,MAA4B;IACtD,MAAM0C,YAAY1C,OAAO2C,KAAK,EAAED,aAAa;IAC7C,MAAME,aAAaF,cAAc,OAAO;QAAC;QAAWA;KAAU,GAAG;QAAC;KAAY;IAC9E,OAAOH,KAAKC,SAAS,CAAC;QAACxC,OAAOqC,WAAW;QAAEO;QAAY5C,OAAO6C,SAAS;QAAE7C,OAAOK,GAAG;KAAC;AACtF;AAEA,SAAS8B,qBAAqBhB,OAAe,EAAEd,GAAW;IACxD,OAAOR,mBAAmB6B,IAAI,CAACP,YAAYd,IAAIY,QAAQ,CAAC,cAAcE;AACxE"}
+{"version":3,"sources":["../../src/core/crypto.ts"],"sourcesContent":["import {\n  decodeBase64Key as decodeEnvelopeKey,\n  KeyConfigurationError,\n  openEnvelopeText,\n  sealEnvelopeText,\n} from '@shipfox/node-envelope-encryption';\nimport {KekConfigurationError, SecretDecryptionError} from './errors.js';\n\nexport interface AesGcmSealParams {\n  key: Buffer;\n  plaintext: Buffer;\n  aad: string;\n}\n\nexport interface AesGcmOpenParams {\n  key: Buffer;\n  encoded: string;\n  aad: string;\n}\n\nexport interface SecretScope {\n  projectId?: string | null | undefined;\n}\n\nexport interface SecretValueAadParams {\n  workspaceId: string;\n  scope?: SecretScope | undefined;\n  namespace: string;\n  key: string;\n}\n\nexport function aesGcmSeal(params: AesGcmSealParams): string {\n  return sealEnvelopeText(params);\n}\n\nexport function aesGcmOpen(params: AesGcmOpenParams): Buffer {\n  try {\n    return openEnvelopeText(params);\n  } catch {\n    throw new SecretDecryptionError();\n  }\n}\n\nexport function decodeBase64Key(encoded: string | undefined, label: string): Buffer {\n  try {\n    return decodeEnvelopeKey(encoded, label);\n  } catch (error) {\n    if (error instanceof KeyConfigurationError) throw new KekConfigurationError(error.message);\n    throw error;\n  }\n}\n\nexport function aadForDek(workspaceId: string, kekVersion: string): string {\n  return JSON.stringify([workspaceId, kekVersion]);\n}\n\nexport function aadForValue(params: SecretValueAadParams): string {\n  const projectId = params.scope?.projectId ?? null;\n  const scopeTuple = projectId !== null ? ['project', projectId] : ['workspace'];\n  return JSON.stringify([params.workspaceId, scopeTuple, params.namespace, params.key]);\n}\n"],"names":["decodeBase64Key","decodeEnvelopeKey","KeyConfigurationError","openEnvelopeText","sealEnvelopeText","KekConfigurationError","SecretDecryptionError","aesGcmSeal","params","aesGcmOpen","encoded","label","error","message","aadForDek","workspaceId","kekVersion","JSON","stringify","aadForValue","projectId","scope","scopeTuple","namespace","key"],"mappings":"AAAA,SACEA,mBAAmBC,iBAAiB,EACpCC,qBAAqB,EACrBC,gBAAgB,EAChBC,gBAAgB,QACX,oCAAoC;AAC3C,SAAQC,qBAAqB,EAAEC,qBAAqB,QAAO,cAAc;AAyBzE,OAAO,SAASC,WAAWC,MAAwB;IACjD,OAAOJ,iBAAiBI;AAC1B;AAEA,OAAO,SAASC,WAAWD,MAAwB;IACjD,IAAI;QACF,OAAOL,iBAAiBK;IAC1B,EAAE,OAAM;QACN,MAAM,IAAIF;IACZ;AACF;AAEA,OAAO,SAASN,gBAAgBU,OAA2B,EAAEC,KAAa;IACxE,IAAI;QACF,OAAOV,kBAAkBS,SAASC;IACpC,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBV,uBAAuB,MAAM,IAAIG,sBAAsBO,MAAMC,OAAO;QACzF,MAAMD;IACR;AACF;AAEA,OAAO,SAASE,UAAUC,WAAmB,EAAEC,UAAkB;IAC/D,OAAOC,KAAKC,SAAS,CAAC;QAACH;QAAaC;KAAW;AACjD;AAEA,OAAO,SAASG,YAAYX,MAA4B;IACtD,MAAMY,YAAYZ,OAAOa,KAAK,EAAED,aAAa;IAC7C,MAAME,aAAaF,cAAc,OAAO;QAAC;QAAWA;KAAU,GAAG;QAAC;KAAY;IAC9E,OAAOH,KAAKC,SAAS,CAAC;QAACV,OAAOO,WAAW;QAAEO;QAAYd,OAAOe,SAAS;QAAEf,OAAOgB,GAAG;KAAC;AACtF"}

package/dist/core/dek-manager.d.ts

@@ -1,9 +1,4 @@
 import type { KeyProvider } from './key-provider.js';
-/**
- * Plaintext DEKs live in memory by design so hot secret reads avoid unwrapping on
- * every access. Node cannot reliably zeroize Buffers, so residency is bounded by
- * LRU size and lazy TTL instead of pretending wipes are a complete mitigation.
- */
 export declare class DekManager {
     #private;
     constructor(keyProvider: KeyProvider, options: {

package/dist/core/dek-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dek-manager.d.ts","sourceRoot":"","sources":["../../src/core/dek-manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,mBAAmB,CAAC;AAInD;;;;GAIG;AACH,qBAAa,UAAU;;IAKrB,YAAY,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,EAGjF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0D1D;IAED,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEpC;CAaF"}
+{"version":3,"file":"dek-manager.d.ts","sourceRoot":"","sources":["../../src/core/dek-manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,mBAAmB,CAAC;AAEnD,qBAAa,UAAU;;IAGrB,YAAY,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,EAkBjF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAa1D;IAED,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEpC;CACF"}

package/dist/core/dek-manager.js

@@ -1,63 +1,35 @@
-import crypto from 'node:crypto';
+import { DataKeyManager } from '@shipfox/node-envelope-encryption';
 import { getDataKey, insertDataKeyIfAbsent } from '#db/index.js';
 import { classifyDekAccessError, recordSecretsDekAccess } from '#metrics/instance.js';
-const DEK_BYTES = 32;
-/**
- * Plaintext DEKs live in memory by design so hot secret reads avoid unwrapping on
- * every access. Node cannot reliably zeroize Buffers, so residency is bounded by
- * LRU size and lazy TTL instead of pretending wipes are a complete mitigation.
- */ export class DekManager {
-    #cache;
-    #keyProvider;
-    #options;
+export class DekManager {
+    #manager;
     constructor(keyProvider, options){
-        this.#cache = new Map();
-        this.#keyProvider = keyProvider;
-        this.#options = options;
+        this.#manager = new DataKeyManager(keyProvider, {
+            async get (workspaceId) {
+                const record = await getDataKey(workspaceId);
+                return record ? {
+                    keyId: workspaceId,
+                    ...record
+                } : undefined;
+            },
+            insertIfAbsent (record) {
+                return insertDataKeyIfAbsent({
+                    workspaceId: record.keyId,
+                    wrappedDek: record.wrappedDek,
+                    kekVersion: record.kekVersion
+                });
+            }
+        }, options);
     }
     async getPlaintextDek(workspaceId) {
         const startedAt = Date.now();
         try {
-            const cached = this.#cache.get(workspaceId);
-            if (cached && cached.expiresAt > Date.now()) {
-                this.#cache.delete(workspaceId);
-                this.#cache.set(workspaceId, cached);
-                recordSecretsDekAccess({
-                    outcome: 'cache_hit',
-                    durationMs: Date.now() - startedAt
-                });
-                return Buffer.from(cached.dek);
-            }
-            const hadExpiredCache = Boolean(cached);
-            if (cached) this.#cache.delete(workspaceId);
-            const existing = await getDataKey(workspaceId);
-            if (existing) {
-                const dek = this.#keyProvider.unwrapDek(workspaceId, existing.wrappedDek, existing.kekVersion);
-                this.#set(workspaceId, dek);
-                recordSecretsDekAccess({
-                    outcome: hadExpiredCache ? 'cache_expired' : 'db_unwrapped',
-                    durationMs: Date.now() - startedAt
-                });
-                return Buffer.from(dek);
-            }
-            const generatedDek = crypto.randomBytes(DEK_BYTES);
-            const wrapped = this.#keyProvider.wrapDek(workspaceId, generatedDek);
-            const inserted = await insertDataKeyIfAbsent({
-                workspaceId,
-                wrappedDek: wrapped.wrappedDek,
-                kekVersion: wrapped.kekVersion
-            });
-            // The DEK row commits before value writes. If concurrent first-use inserts race,
-            // the primary key decides the winner and every caller re-reads the persisted row.
-            const persisted = await getDataKey(workspaceId);
-            if (!persisted) throw new Error(`Data key was not persisted for workspace ${workspaceId}`);
-            const dek = this.#keyProvider.unwrapDek(workspaceId, persisted.wrappedDek, persisted.kekVersion);
-            this.#set(workspaceId, dek);
+            const result = await this.#manager.getPlaintextDataKey(workspaceId);
             recordSecretsDekAccess({
-                outcome: inserted ? 'generated' : 'db_unwrapped',
+                outcome: result.outcome,
                 durationMs: Date.now() - startedAt
             });
-            return Buffer.from(dek);
+            return result.dek;
         } catch (error) {
             recordSecretsDekAccess({
                 outcome: classifyDekAccessError(error),
@@ -67,18 +39,7 @@ const DEK_BYTES = 32;
         }
     }
     invalidate(workspaceId) {
-        this.#cache.delete(workspaceId);
-    }
-    #set(workspaceId, dek) {
-        this.#cache.set(workspaceId, {
-            dek: Buffer.from(dek),
-            expiresAt: Date.now() + this.#options.ttlMs
-        });
-        while(this.#cache.size > this.#options.maxEntries){
-            const oldest = this.#cache.keys().next().value;
-            if (!oldest) break;
-            this.#cache.delete(oldest);
-        }
+        this.#manager.invalidate(workspaceId);
     }
 }
 

package/dist/core/dek-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/dek-manager.ts"],"sourcesContent":["import crypto from 'node:crypto';\nimport {getDataKey, insertDataKeyIfAbsent} from '#db/index.js';\nimport {classifyDekAccessError, recordSecretsDekAccess} from '#metrics/instance.js';\nimport type {KeyProvider} from './key-provider.js';\n\nconst DEK_BYTES = 32;\n\n/**\n * Plaintext DEKs live in memory by design so hot secret reads avoid unwrapping on\n * every access. Node cannot reliably zeroize Buffers, so residency is bounded by\n * LRU size and lazy TTL instead of pretending wipes are a complete mitigation.\n */\nexport class DekManager {\n  readonly #cache = new Map<string, {dek: Buffer; expiresAt: number}>();\n  readonly #keyProvider: KeyProvider;\n  readonly #options: {maxEntries: number; ttlMs: number};\n\n  constructor(keyProvider: KeyProvider, options: {maxEntries: number; ttlMs: number}) {\n    this.#keyProvider = keyProvider;\n    this.#options = options;\n  }\n\n  async getPlaintextDek(workspaceId: string): Promise<Buffer> {\n    const startedAt = Date.now();\n    try {\n      const cached = this.#cache.get(workspaceId);\n      if (cached && cached.expiresAt > Date.now()) {\n        this.#cache.delete(workspaceId);\n        this.#cache.set(workspaceId, cached);\n        recordSecretsDekAccess({outcome: 'cache_hit', durationMs: Date.now() - startedAt});\n        return Buffer.from(cached.dek);\n      }\n      const hadExpiredCache = Boolean(cached);\n      if (cached) this.#cache.delete(workspaceId);\n\n      const existing = await getDataKey(workspaceId);\n      if (existing) {\n        const dek = this.#keyProvider.unwrapDek(\n          workspaceId,\n          existing.wrappedDek,\n          existing.kekVersion,\n        );\n        this.#set(workspaceId, dek);\n        recordSecretsDekAccess({\n          outcome: hadExpiredCache ? 'cache_expired' : 'db_unwrapped',\n          durationMs: Date.now() - startedAt,\n        });\n        return Buffer.from(dek);\n      }\n\n      const generatedDek = crypto.randomBytes(DEK_BYTES);\n      const wrapped = this.#keyProvider.wrapDek(workspaceId, generatedDek);\n      const inserted = await insertDataKeyIfAbsent({\n        workspaceId,\n        wrappedDek: wrapped.wrappedDek,\n        kekVersion: wrapped.kekVersion,\n      });\n\n      // The DEK row commits before value writes. If concurrent first-use inserts race,\n      // the primary key decides the winner and every caller re-reads the persisted row.\n      const persisted = await getDataKey(workspaceId);\n      if (!persisted) throw new Error(`Data key was not persisted for workspace ${workspaceId}`);\n      const dek = this.#keyProvider.unwrapDek(\n        workspaceId,\n        persisted.wrappedDek,\n        persisted.kekVersion,\n      );\n      this.#set(workspaceId, dek);\n      recordSecretsDekAccess({\n        outcome: inserted ? 'generated' : 'db_unwrapped',\n        durationMs: Date.now() - startedAt,\n      });\n      return Buffer.from(dek);\n    } catch (error) {\n      recordSecretsDekAccess({\n        outcome: classifyDekAccessError(error),\n        durationMs: Date.now() - startedAt,\n      });\n      throw error;\n    }\n  }\n\n  invalidate(workspaceId: string): void {\n    this.#cache.delete(workspaceId);\n  }\n\n  #set(workspaceId: string, dek: Buffer): void {\n    this.#cache.set(workspaceId, {\n      dek: Buffer.from(dek),\n      expiresAt: Date.now() + this.#options.ttlMs,\n    });\n    while (this.#cache.size > this.#options.maxEntries) {\n      const oldest = this.#cache.keys().next().value as string | undefined;\n      if (!oldest) break;\n      this.#cache.delete(oldest);\n    }\n  }\n}\n"],"names":["crypto","getDataKey","insertDataKeyIfAbsent","classifyDekAccessError","recordSecretsDekAccess","DEK_BYTES","DekManager","keyProvider","options","Map","getPlaintextDek","workspaceId","startedAt","Date","now","cached","get","expiresAt","delete","set","outcome","durationMs","Buffer","from","dek","hadExpiredCache","Boolean","existing","unwrapDek","wrappedDek","kekVersion","generatedDek","randomBytes","wrapped","wrapDek","inserted","persisted","Error","error","invalidate","ttlMs","size","maxEntries","oldest","keys","next","value"],"mappings":"AAAA,OAAOA,YAAY,cAAc;AACjC,SAAQC,UAAU,EAAEC,qBAAqB,QAAO,eAAe;AAC/D,SAAQC,sBAAsB,EAAEC,sBAAsB,QAAO,uBAAuB;AAGpF,MAAMC,YAAY;AAElB;;;;CAIC,GACD,OAAO,MAAMC;IACF,CAAA,KAAM,CAAuD;IAC7D,CAAA,WAAY,CAAc;IAC1B,CAAA,OAAQ,CAAsC;IAEvD,YAAYC,WAAwB,EAAEC,OAA4C,CAAE;aAJ3E,CAAA,KAAM,GAAG,IAAIC;QAKpB,IAAI,CAAC,CAAA,WAAY,GAAGF;QACpB,IAAI,CAAC,CAAA,OAAQ,GAAGC;IAClB;IAEA,MAAME,gBAAgBC,WAAmB,EAAmB;QAC1D,MAAMC,YAAYC,KAAKC,GAAG;QAC1B,IAAI;YACF,MAAMC,SAAS,IAAI,CAAC,CAAA,KAAM,CAACC,GAAG,CAACL;YAC/B,IAAII,UAAUA,OAAOE,SAAS,GAAGJ,KAAKC,GAAG,IAAI;gBAC3C,IAAI,CAAC,CAAA,KAAM,CAACI,MAAM,CAACP;gBACnB,IAAI,CAAC,CAAA,KAAM,CAACQ,GAAG,CAACR,aAAaI;gBAC7BX,uBAAuB;oBAACgB,SAAS;oBAAaC,YAAYR,KAAKC,GAAG,KAAKF;gBAAS;gBAChF,OAAOU,OAAOC,IAAI,CAACR,OAAOS,GAAG;YAC/B;YACA,MAAMC,kBAAkBC,QAAQX;YAChC,IAAIA,QAAQ,IAAI,CAAC,CAAA,KAAM,CAACG,MAAM,CAACP;YAE/B,MAAMgB,WAAW,MAAM1B,WAAWU;YAClC,IAAIgB,UAAU;gBACZ,MAAMH,MAAM,IAAI,CAAC,CAAA,WAAY,CAACI,SAAS,CACrCjB,aACAgB,SAASE,UAAU,EACnBF,SAASG,UAAU;gBAErB,IAAI,CAAC,CAAA,GAAI,CAACnB,aAAaa;gBACvBpB,uBAAuB;oBACrBgB,SAASK,kBAAkB,kBAAkB;oBAC7CJ,YAAYR,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOU,OAAOC,IAAI,CAACC;YACrB;YAEA,MAAMO,eAAe/B,OAAOgC,WAAW,CAAC3B;YACxC,MAAM4B,UAAU,IAAI,CAAC,CAAA,WAAY,CAACC,OAAO,CAACvB,aAAaoB;YACvD,MAAMI,WAAW,MAAMjC,sBAAsB;gBAC3CS;gBACAkB,YAAYI,QAAQJ,UAAU;gBAC9BC,YAAYG,QAAQH,UAAU;YAChC;YAEA,iFAAiF;YACjF,kFAAkF;YAClF,MAAMM,YAAY,MAAMnC,WAAWU;YACnC,IAAI,CAACyB,WAAW,MAAM,IAAIC,MAAM,CAAC,yCAAyC,EAAE1B,aAAa;YACzF,MAAMa,MAAM,IAAI,CAAC,CAAA,WAAY,CAACI,SAAS,CACrCjB,aACAyB,UAAUP,UAAU,EACpBO,UAAUN,UAAU;YAEtB,IAAI,CAAC,CAAA,GAAI,CAACnB,aAAaa;YACvBpB,uBAAuB;gBACrBgB,SAASe,WAAW,cAAc;gBAClCd,YAAYR,KAAKC,GAAG,KAAKF;YAC3B;YACA,OAAOU,OAAOC,IAAI,CAACC;QACrB,EAAE,OAAOc,OAAO;YACdlC,uBAAuB;gBACrBgB,SAASjB,uBAAuBmC;gBAChCjB,YAAYR,KAAKC,GAAG,KAAKF;YAC3B;YACA,MAAM0B;QACR;IACF;IAEAC,WAAW5B,WAAmB,EAAQ;QACpC,IAAI,CAAC,CAAA,KAAM,CAACO,MAAM,CAACP;IACrB;IAEA,CAAA,GAAI,CAACA,WAAmB,EAAEa,GAAW;QACnC,IAAI,CAAC,CAAA,KAAM,CAACL,GAAG,CAACR,aAAa;YAC3Ba,KAAKF,OAAOC,IAAI,CAACC;YACjBP,WAAWJ,KAAKC,GAAG,KAAK,IAAI,CAAC,CAAA,OAAQ,CAAC0B,KAAK;QAC7C;QACA,MAAO,IAAI,CAAC,CAAA,KAAM,CAACC,IAAI,GAAG,IAAI,CAAC,CAAA,OAAQ,CAACC,UAAU,CAAE;YAClD,MAAMC,SAAS,IAAI,CAAC,CAAA,KAAM,CAACC,IAAI,GAAGC,IAAI,GAAGC,KAAK;YAC9C,IAAI,CAACH,QAAQ;YACb,IAAI,CAAC,CAAA,KAAM,CAACzB,MAAM,CAACyB;QACrB;IACF;AACF"}
+{"version":3,"sources":["../../src/core/dek-manager.ts"],"sourcesContent":["import {DataKeyManager} from '@shipfox/node-envelope-encryption';\nimport {getDataKey, insertDataKeyIfAbsent} from '#db/index.js';\nimport {classifyDekAccessError, recordSecretsDekAccess} from '#metrics/instance.js';\nimport type {KeyProvider} from './key-provider.js';\n\nexport class DekManager {\n  readonly #manager: DataKeyManager;\n\n  constructor(keyProvider: KeyProvider, options: {maxEntries: number; ttlMs: number}) {\n    this.#manager = new DataKeyManager(\n      keyProvider,\n      {\n        async get(workspaceId) {\n          const record = await getDataKey(workspaceId);\n          return record ? {keyId: workspaceId, ...record} : undefined;\n        },\n        insertIfAbsent(record) {\n          return insertDataKeyIfAbsent({\n            workspaceId: record.keyId,\n            wrappedDek: record.wrappedDek,\n            kekVersion: record.kekVersion,\n          });\n        },\n      },\n      options,\n    );\n  }\n\n  async getPlaintextDek(workspaceId: string): Promise<Buffer> {\n    const startedAt = Date.now();\n    try {\n      const result = await this.#manager.getPlaintextDataKey(workspaceId);\n      recordSecretsDekAccess({outcome: result.outcome, durationMs: Date.now() - startedAt});\n      return result.dek;\n    } catch (error) {\n      recordSecretsDekAccess({\n        outcome: classifyDekAccessError(error),\n        durationMs: Date.now() - startedAt,\n      });\n      throw error;\n    }\n  }\n\n  invalidate(workspaceId: string): void {\n    this.#manager.invalidate(workspaceId);\n  }\n}\n"],"names":["DataKeyManager","getDataKey","insertDataKeyIfAbsent","classifyDekAccessError","recordSecretsDekAccess","DekManager","keyProvider","options","get","workspaceId","record","keyId","undefined","insertIfAbsent","wrappedDek","kekVersion","getPlaintextDek","startedAt","Date","now","result","getPlaintextDataKey","outcome","durationMs","dek","error","invalidate"],"mappings":"AAAA,SAAQA,cAAc,QAAO,oCAAoC;AACjE,SAAQC,UAAU,EAAEC,qBAAqB,QAAO,eAAe;AAC/D,SAAQC,sBAAsB,EAAEC,sBAAsB,QAAO,uBAAuB;AAGpF,OAAO,MAAMC;IACF,CAAA,OAAQ,CAAiB;IAElC,YAAYC,WAAwB,EAAEC,OAA4C,CAAE;QAClF,IAAI,CAAC,CAAA,OAAQ,GAAG,IAAIP,eAClBM,aACA;YACE,MAAME,KAAIC,WAAW;gBACnB,MAAMC,SAAS,MAAMT,WAAWQ;gBAChC,OAAOC,SAAS;oBAACC,OAAOF;oBAAa,GAAGC,MAAM;gBAAA,IAAIE;YACpD;YACAC,gBAAeH,MAAM;gBACnB,OAAOR,sBAAsB;oBAC3BO,aAAaC,OAAOC,KAAK;oBACzBG,YAAYJ,OAAOI,UAAU;oBAC7BC,YAAYL,OAAOK,UAAU;gBAC/B;YACF;QACF,GACAR;IAEJ;IAEA,MAAMS,gBAAgBP,WAAmB,EAAmB;QAC1D,MAAMQ,YAAYC,KAAKC,GAAG;QAC1B,IAAI;YACF,MAAMC,SAAS,MAAM,IAAI,CAAC,CAAA,OAAQ,CAACC,mBAAmB,CAACZ;YACvDL,uBAAuB;gBAACkB,SAASF,OAAOE,OAAO;gBAAEC,YAAYL,KAAKC,GAAG,KAAKF;YAAS;YACnF,OAAOG,OAAOI,GAAG;QACnB,EAAE,OAAOC,OAAO;YACdrB,uBAAuB;gBACrBkB,SAASnB,uBAAuBsB;gBAChCF,YAAYL,KAAKC,GAAG,KAAKF;YAC3B;YACA,MAAMQ;QACR;IACF;IAEAC,WAAWjB,WAAmB,EAAQ;QACpC,IAAI,CAAC,CAAA,OAAQ,CAACiB,UAAU,CAACjB;IAC3B;AACF"}

package/dist/core/key-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-provider.d.ts","sourceRoot":"","sources":["../../src/core/key-provider.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAChF;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,WAAW,CAyClF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGzD"}
+{"version":3,"file":"key-provider.d.ts","sourceRoot":"","sources":["../../src/core/key-provider.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAChF;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,WAAW,CAsBlF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/core/key-provider.js

@@ -1,45 +1,34 @@
-import crypto from 'node:crypto';
-import { aadForDek, aesGcmOpen, aesGcmSeal } from './crypto.js';
+import { createLocalKeyProvider as createEnvelopeKeyProvider, DataKeyUnwrapError, DataKeyWrapError, deriveLocalKeyVersion } from '@shipfox/node-envelope-encryption';
 import { DekUnwrapError, DekWrapError } from './errors.js';
 const KEK_VERSION_DOMAIN = 'shipfox-secrets-kek-version';
 export function createLocalKeyProvider(params) {
-    const currentKeyVersion = deriveLocalKekVersion(params.currentKek);
-    const previousKeyVersion = params.previousKek ? deriveLocalKekVersion(params.previousKek) : null;
+    const provider = createEnvelopeKeyProvider({
+        ...params,
+        keyVersionDomain: KEK_VERSION_DOMAIN
+    });
     return {
-        currentKeyVersion,
-        previousKeyVersion,
+        currentKeyVersion: provider.currentKeyVersion,
+        previousKeyVersion: provider.previousKeyVersion,
         wrapDek (workspaceId, plaintextDek) {
             try {
-                return {
-                    wrappedDek: aesGcmSeal({
-                        key: params.currentKek,
-                        plaintext: plaintextDek,
-                        aad: aadForDek(workspaceId, currentKeyVersion)
-                    }),
-                    kekVersion: currentKeyVersion
-                };
-            } catch  {
-                throw new DekWrapError();
+                return provider.wrapDek(workspaceId, plaintextDek);
+            } catch (error) {
+                if (error instanceof DataKeyWrapError) throw new DekWrapError();
+                throw error;
             }
         },
         unwrapDek (workspaceId, wrappedDek, kekVersion) {
-            const key = kekVersion === currentKeyVersion ? params.currentKek : kekVersion === previousKeyVersion ? params.previousKek : undefined;
-            if (!key) throw new DekUnwrapError();
             try {
-                return aesGcmOpen({
-                    key,
-                    encoded: wrappedDek,
-                    aad: aadForDek(workspaceId, kekVersion)
-                });
-            } catch  {
-                throw new DekUnwrapError();
+                return provider.unwrapDek(workspaceId, wrappedDek, kekVersion);
+            } catch (error) {
+                if (error instanceof DataKeyUnwrapError) throw new DekUnwrapError();
+                throw error;
             }
         }
     };
 }
 export function deriveLocalKekVersion(kek) {
-    const hash = crypto.createHash('sha256').update(KEK_VERSION_DOMAIN).update(kek).digest('hex');
-    return `local:${hash.slice(0, 16)}`;
+    return deriveLocalKeyVersion(kek, KEK_VERSION_DOMAIN);
 }
 
 //# sourceMappingURL=key-provider.js.map

package/dist/core/key-provider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/key-provider.ts"],"sourcesContent":["import crypto from 'node:crypto';\nimport {aadForDek, aesGcmOpen, aesGcmSeal} from './crypto.js';\nimport {DekUnwrapError, DekWrapError} from './errors.js';\n\nconst KEK_VERSION_DOMAIN = 'shipfox-secrets-kek-version';\n\nexport interface WrappedDek {\n  wrappedDek: string;\n  kekVersion: string;\n}\n\nexport interface KeyProvider {\n  readonly currentKeyVersion: string;\n  readonly previousKeyVersion: string | null;\n  wrapDek(workspaceId: string, plaintextDek: Buffer): WrappedDek;\n  unwrapDek(workspaceId: string, wrappedDek: string, kekVersion: string): Buffer;\n}\n\nexport interface LocalKeyProviderParams {\n  currentKek: Buffer;\n  previousKek?: Buffer | undefined;\n}\n\nexport function createLocalKeyProvider(params: LocalKeyProviderParams): KeyProvider {\n  const currentKeyVersion = deriveLocalKekVersion(params.currentKek);\n  const previousKeyVersion = params.previousKek ? deriveLocalKekVersion(params.previousKek) : null;\n\n  return {\n    currentKeyVersion,\n    previousKeyVersion,\n    wrapDek(workspaceId, plaintextDek) {\n      try {\n        return {\n          wrappedDek: aesGcmSeal({\n            key: params.currentKek,\n            plaintext: plaintextDek,\n            aad: aadForDek(workspaceId, currentKeyVersion),\n          }),\n          kekVersion: currentKeyVersion,\n        };\n      } catch {\n        throw new DekWrapError();\n      }\n    },\n    unwrapDek(workspaceId, wrappedDek, kekVersion) {\n      const key =\n        kekVersion === currentKeyVersion\n          ? params.currentKek\n          : kekVersion === previousKeyVersion\n            ? params.previousKek\n            : undefined;\n      if (!key) throw new DekUnwrapError();\n\n      try {\n        return aesGcmOpen({\n          key,\n          encoded: wrappedDek,\n          aad: aadForDek(workspaceId, kekVersion),\n        });\n      } catch {\n        throw new DekUnwrapError();\n      }\n    },\n  };\n}\n\nexport function deriveLocalKekVersion(kek: Buffer): string {\n  const hash = crypto.createHash('sha256').update(KEK_VERSION_DOMAIN).update(kek).digest('hex');\n  return `local:${hash.slice(0, 16)}`;\n}\n"],"names":["crypto","aadForDek","aesGcmOpen","aesGcmSeal","DekUnwrapError","DekWrapError","KEK_VERSION_DOMAIN","createLocalKeyProvider","params","currentKeyVersion","deriveLocalKekVersion","currentKek","previousKeyVersion","previousKek","wrapDek","workspaceId","plaintextDek","wrappedDek","key","plaintext","aad","kekVersion","unwrapDek","undefined","encoded","kek","hash","createHash","update","digest","slice"],"mappings":"AAAA,OAAOA,YAAY,cAAc;AACjC,SAAQC,SAAS,EAAEC,UAAU,EAAEC,UAAU,QAAO,cAAc;AAC9D,SAAQC,cAAc,EAAEC,YAAY,QAAO,cAAc;AAEzD,MAAMC,qBAAqB;AAmB3B,OAAO,SAASC,uBAAuBC,MAA8B;IACnE,MAAMC,oBAAoBC,sBAAsBF,OAAOG,UAAU;IACjE,MAAMC,qBAAqBJ,OAAOK,WAAW,GAAGH,sBAAsBF,OAAOK,WAAW,IAAI;IAE5F,OAAO;QACLJ;QACAG;QACAE,SAAQC,WAAW,EAAEC,YAAY;YAC/B,IAAI;gBACF,OAAO;oBACLC,YAAYd,WAAW;wBACrBe,KAAKV,OAAOG,UAAU;wBACtBQ,WAAWH;wBACXI,KAAKnB,UAAUc,aAAaN;oBAC9B;oBACAY,YAAYZ;gBACd;YACF,EAAE,OAAM;gBACN,MAAM,IAAIJ;YACZ;QACF;QACAiB,WAAUP,WAAW,EAAEE,UAAU,EAAEI,UAAU;YAC3C,MAAMH,MACJG,eAAeZ,oBACXD,OAAOG,UAAU,GACjBU,eAAeT,qBACbJ,OAAOK,WAAW,GAClBU;YACR,IAAI,CAACL,KAAK,MAAM,IAAId;YAEpB,IAAI;gBACF,OAAOF,WAAW;oBAChBgB;oBACAM,SAASP;oBACTG,KAAKnB,UAAUc,aAAaM;gBAC9B;YACF,EAAE,OAAM;gBACN,MAAM,IAAIjB;YACZ;QACF;IACF;AACF;AAEA,OAAO,SAASM,sBAAsBe,GAAW;IAC/C,MAAMC,OAAO1B,OAAO2B,UAAU,CAAC,UAAUC,MAAM,CAACtB,oBAAoBsB,MAAM,CAACH,KAAKI,MAAM,CAAC;IACvF,OAAO,CAAC,MAAM,EAAEH,KAAKI,KAAK,CAAC,GAAG,KAAK;AACrC"}
+{"version":3,"sources":["../../src/core/key-provider.ts"],"sourcesContent":["import {\n  createLocalKeyProvider as createEnvelopeKeyProvider,\n  DataKeyUnwrapError,\n  DataKeyWrapError,\n  deriveLocalKeyVersion,\n} from '@shipfox/node-envelope-encryption';\nimport {DekUnwrapError, DekWrapError} from './errors.js';\n\nconst KEK_VERSION_DOMAIN = 'shipfox-secrets-kek-version';\n\nexport interface WrappedDek {\n  wrappedDek: string;\n  kekVersion: string;\n}\n\nexport interface KeyProvider {\n  readonly currentKeyVersion: string;\n  readonly previousKeyVersion: string | null;\n  wrapDek(workspaceId: string, plaintextDek: Buffer): WrappedDek;\n  unwrapDek(workspaceId: string, wrappedDek: string, kekVersion: string): Buffer;\n}\n\nexport interface LocalKeyProviderParams {\n  currentKek: Buffer;\n  previousKek?: Buffer | undefined;\n}\n\nexport function createLocalKeyProvider(params: LocalKeyProviderParams): KeyProvider {\n  const provider = createEnvelopeKeyProvider({...params, keyVersionDomain: KEK_VERSION_DOMAIN});\n  return {\n    currentKeyVersion: provider.currentKeyVersion,\n    previousKeyVersion: provider.previousKeyVersion,\n    wrapDek(workspaceId, plaintextDek) {\n      try {\n        return provider.wrapDek(workspaceId, plaintextDek);\n      } catch (error) {\n        if (error instanceof DataKeyWrapError) throw new DekWrapError();\n        throw error;\n      }\n    },\n    unwrapDek(workspaceId, wrappedDek, kekVersion) {\n      try {\n        return provider.unwrapDek(workspaceId, wrappedDek, kekVersion);\n      } catch (error) {\n        if (error instanceof DataKeyUnwrapError) throw new DekUnwrapError();\n        throw error;\n      }\n    },\n  };\n}\n\nexport function deriveLocalKekVersion(kek: Buffer): string {\n  return deriveLocalKeyVersion(kek, KEK_VERSION_DOMAIN);\n}\n"],"names":["createLocalKeyProvider","createEnvelopeKeyProvider","DataKeyUnwrapError","DataKeyWrapError","deriveLocalKeyVersion","DekUnwrapError","DekWrapError","KEK_VERSION_DOMAIN","params","provider","keyVersionDomain","currentKeyVersion","previousKeyVersion","wrapDek","workspaceId","plaintextDek","error","unwrapDek","wrappedDek","kekVersion","deriveLocalKekVersion","kek"],"mappings":"AAAA,SACEA,0BAA0BC,yBAAyB,EACnDC,kBAAkB,EAClBC,gBAAgB,EAChBC,qBAAqB,QAChB,oCAAoC;AAC3C,SAAQC,cAAc,EAAEC,YAAY,QAAO,cAAc;AAEzD,MAAMC,qBAAqB;AAmB3B,OAAO,SAASP,uBAAuBQ,MAA8B;IACnE,MAAMC,WAAWR,0BAA0B;QAAC,GAAGO,MAAM;QAAEE,kBAAkBH;IAAkB;IAC3F,OAAO;QACLI,mBAAmBF,SAASE,iBAAiB;QAC7CC,oBAAoBH,SAASG,kBAAkB;QAC/CC,SAAQC,WAAW,EAAEC,YAAY;YAC/B,IAAI;gBACF,OAAON,SAASI,OAAO,CAACC,aAAaC;YACvC,EAAE,OAAOC,OAAO;gBACd,IAAIA,iBAAiBb,kBAAkB,MAAM,IAAIG;gBACjD,MAAMU;YACR;QACF;QACAC,WAAUH,WAAW,EAAEI,UAAU,EAAEC,UAAU;YAC3C,IAAI;gBACF,OAAOV,SAASQ,SAAS,CAACH,aAAaI,YAAYC;YACrD,EAAE,OAAOH,OAAO;gBACd,IAAIA,iBAAiBd,oBAAoB,MAAM,IAAIG;gBACnD,MAAMW;YACR;QACF;IACF;AACF;AAEA,OAAO,SAASI,sBAAsBC,GAAW;IAC/C,OAAOjB,sBAAsBiB,KAAKd;AACpC"}

package/dist/core/rotate-kek.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotate-kek.d.ts","sourceRoot":"","sources":["../../src/core/rotate-kek.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,mBAAmB,CAAC;AAInD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC;AAED,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,WAAW,EACxB,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CAqExC"}
+{"version":3,"file":"rotate-kek.d.ts","sourceRoot":"","sources":["../../src/core/rotate-kek.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC;AAED,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,WAAW,EACxB,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CA4BxC"}

package/dist/core/rotate-kek.js

@@ -1,94 +1,40 @@
+import { rotateDataKeysWithTelemetry } from '@shipfox/node-envelope-encryption';
 import { listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas } from '#db/index.js';
 import { classifyKekRotationError, recordSecretsKekRotation } from '#metrics/instance.js';
 import { KekVersionStrandedError } from './errors.js';
-const PAGE_SIZE = 100;
-export async function rotateWorkspaceDataKeysWithProvider(keyProvider, options = {}) {
-    const startedAt = Date.now();
-    try {
-        const knownVersions = [
-            keyProvider.currentKeyVersion,
-            keyProvider.previousKeyVersion
-        ].filter((version)=>Boolean(version));
-        const unknownVersions = await listDataKeyVersions(knownVersions, {
-            workspaceIds: options.workspaceIds
-        });
-        if (unknownVersions.length > 0) throw new KekVersionStrandedError(unknownVersions[0]);
-        let rotated = 0;
-        let skipped = 0;
-        let skippedCurrent = 0;
-        let skippedRace = 0;
-        let afterWorkspaceId;
-        while(true){
-            const page = await listDataKeysPage({
-                afterWorkspaceId,
-                limit: PAGE_SIZE,
-                workspaceIds: options.workspaceIds
-            });
-            if (page.length === 0) break;
-            for (const row of page){
-                afterWorkspaceId = row.workspaceId;
-                if (row.kekVersion === keyProvider.currentKeyVersion) {
-                    skipped += 1;
-                    skippedCurrent += 1;
-                    continue;
-                }
-                const plaintextDek = keyProvider.unwrapDek(row.workspaceId, row.wrappedDek, row.kekVersion);
-                try {
-                    const wrapped = keyProvider.wrapDek(row.workspaceId, plaintextDek);
-                    const updated = await updateDataKeyWrapCas({
-                        workspaceId: row.workspaceId,
-                        oldKekVersion: row.kekVersion,
-                        wrappedDek: wrapped.wrappedDek,
-                        kekVersion: wrapped.kekVersion
-                    });
-                    if (updated) rotated += 1;
-                    else {
-                        skipped += 1;
-                        skippedRace += 1;
-                    }
-                } finally{
-                    plaintextDek.fill(0);
-                }
+export function rotateWorkspaceDataKeysWithProvider(keyProvider, options = {}) {
+    return rotateDataKeysWithTelemetry({
+        keyProvider,
+        repository: {
+            listUnknownKeyVersions (knownVersions) {
+                return listDataKeyVersions(knownVersions, {
+                    workspaceIds: options.workspaceIds
+                });
+            },
+            async listPage (params) {
+                const rows = await listDataKeysPage({
+                    afterWorkspaceId: params.afterKeyId,
+                    limit: params.limit,
+                    workspaceIds: options.workspaceIds
+                });
+                return rows.map((row)=>({
+                        keyId: row.workspaceId,
+                        ...row
+                    }));
+            },
+            updateWrapCas (params) {
+                return updateDataKeyWrapCas({
+                    workspaceId: params.keyId,
+                    oldKekVersion: params.oldKekVersion,
+                    wrappedDek: params.wrappedDek,
+                    kekVersion: params.kekVersion
+                });
             }
-        }
-        recordSecretsKekRotation({
-            outcome: 'rotated',
-            count: rotated
-        });
-        recordSecretsKekRotation({
-            outcome: 'skipped_current',
-            count: skippedCurrent
-        });
-        recordSecretsKekRotation({
-            outcome: 'skipped_race',
-            count: skippedRace
-        });
-        recordSecretsKekRotation({
-            outcome: rotationDurationOutcome({
-                rotated,
-                skippedCurrent,
-                skippedRace
-            }),
-            count: 0,
-            durationMs: Date.now() - startedAt
-        });
-        return {
-            rotated,
-            skipped
-        };
-    } catch (error) {
-        recordSecretsKekRotation({
-            outcome: classifyKekRotationError(error),
-            durationMs: Date.now() - startedAt
-        });
-        throw error;
-    }
-}
-function rotationDurationOutcome(params) {
-    if (params.rotated > 0) return 'rotated';
-    if (params.skippedRace > 0) return 'skipped_race';
-    if (params.skippedCurrent === 0) return 'none';
-    return 'skipped_current';
+        },
+        record: recordSecretsKekRotation,
+        classifyError: classifyKekRotationError,
+        strandedError: (keyVersion)=>new KekVersionStrandedError(keyVersion)
+    });
 }
 
 //# sourceMappingURL=rotate-kek.js.map

package/dist/core/rotate-kek.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/rotate-kek.ts"],"sourcesContent":["import {listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas} from '#db/index.js';\nimport {classifyKekRotationError, recordSecretsKekRotation} from '#metrics/instance.js';\nimport {KekVersionStrandedError} from './errors.js';\nimport type {KeyProvider} from './key-provider.js';\n\nconst PAGE_SIZE = 100;\n\nexport interface RotateWorkspaceDataKeysResult {\n  rotated: number;\n  skipped: number;\n}\n\nexport interface RotateWorkspaceDataKeysOptions {\n  workspaceIds?: string[] | undefined;\n}\n\nexport async function rotateWorkspaceDataKeysWithProvider(\n  keyProvider: KeyProvider,\n  options: RotateWorkspaceDataKeysOptions = {},\n): Promise<RotateWorkspaceDataKeysResult> {\n  const startedAt = Date.now();\n  try {\n    const knownVersions = [keyProvider.currentKeyVersion, keyProvider.previousKeyVersion].filter(\n      (version): version is string => Boolean(version),\n    );\n    const unknownVersions = await listDataKeyVersions(knownVersions, {\n      workspaceIds: options.workspaceIds,\n    });\n    if (unknownVersions.length > 0) throw new KekVersionStrandedError(unknownVersions[0] as string);\n\n    let rotated = 0;\n    let skipped = 0;\n    let skippedCurrent = 0;\n    let skippedRace = 0;\n    let afterWorkspaceId: string | undefined;\n\n    while (true) {\n      const page = await listDataKeysPage({\n        afterWorkspaceId,\n        limit: PAGE_SIZE,\n        workspaceIds: options.workspaceIds,\n      });\n      if (page.length === 0) break;\n\n      for (const row of page) {\n        afterWorkspaceId = row.workspaceId;\n        if (row.kekVersion === keyProvider.currentKeyVersion) {\n          skipped += 1;\n          skippedCurrent += 1;\n          continue;\n        }\n\n        const plaintextDek = keyProvider.unwrapDek(row.workspaceId, row.wrappedDek, row.kekVersion);\n        try {\n          const wrapped = keyProvider.wrapDek(row.workspaceId, plaintextDek);\n          const updated = await updateDataKeyWrapCas({\n            workspaceId: row.workspaceId,\n            oldKekVersion: row.kekVersion,\n            wrappedDek: wrapped.wrappedDek,\n            kekVersion: wrapped.kekVersion,\n          });\n          if (updated) rotated += 1;\n          else {\n            skipped += 1;\n            skippedRace += 1;\n          }\n        } finally {\n          plaintextDek.fill(0);\n        }\n      }\n    }\n\n    recordSecretsKekRotation({outcome: 'rotated', count: rotated});\n    recordSecretsKekRotation({outcome: 'skipped_current', count: skippedCurrent});\n    recordSecretsKekRotation({outcome: 'skipped_race', count: skippedRace});\n    recordSecretsKekRotation({\n      outcome: rotationDurationOutcome({rotated, skippedCurrent, skippedRace}),\n      count: 0,\n      durationMs: Date.now() - startedAt,\n    });\n    return {rotated, skipped};\n  } catch (error) {\n    recordSecretsKekRotation({\n      outcome: classifyKekRotationError(error),\n      durationMs: Date.now() - startedAt,\n    });\n    throw error;\n  }\n}\n\nfunction rotationDurationOutcome(params: {\n  rotated: number;\n  skippedCurrent: number;\n  skippedRace: number;\n}) {\n  if (params.rotated > 0) return 'rotated';\n  if (params.skippedRace > 0) return 'skipped_race';\n  if (params.skippedCurrent === 0) return 'none';\n  return 'skipped_current';\n}\n"],"names":["listDataKeysPage","listDataKeyVersions","updateDataKeyWrapCas","classifyKekRotationError","recordSecretsKekRotation","KekVersionStrandedError","PAGE_SIZE","rotateWorkspaceDataKeysWithProvider","keyProvider","options","startedAt","Date","now","knownVersions","currentKeyVersion","previousKeyVersion","filter","version","Boolean","unknownVersions","workspaceIds","length","rotated","skipped","skippedCurrent","skippedRace","afterWorkspaceId","page","limit","row","workspaceId","kekVersion","plaintextDek","unwrapDek","wrappedDek","wrapped","wrapDek","updated","oldKekVersion","fill","outcome","count","rotationDurationOutcome","durationMs","error","params"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,mBAAmB,EAAEC,oBAAoB,QAAO,eAAe;AACzF,SAAQC,wBAAwB,EAAEC,wBAAwB,QAAO,uBAAuB;AACxF,SAAQC,uBAAuB,QAAO,cAAc;AAGpD,MAAMC,YAAY;AAWlB,OAAO,eAAeC,oCACpBC,WAAwB,EACxBC,UAA0C,CAAC,CAAC;IAE5C,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,IAAI;QACF,MAAMC,gBAAgB;YAACL,YAAYM,iBAAiB;YAAEN,YAAYO,kBAAkB;SAAC,CAACC,MAAM,CAC1F,CAACC,UAA+BC,QAAQD;QAE1C,MAAME,kBAAkB,MAAMlB,oBAAoBY,eAAe;YAC/DO,cAAcX,QAAQW,YAAY;QACpC;QACA,IAAID,gBAAgBE,MAAM,GAAG,GAAG,MAAM,IAAIhB,wBAAwBc,eAAe,CAAC,EAAE;QAEpF,IAAIG,UAAU;QACd,IAAIC,UAAU;QACd,IAAIC,iBAAiB;QACrB,IAAIC,cAAc;QAClB,IAAIC;QAEJ,MAAO,KAAM;YACX,MAAMC,OAAO,MAAM3B,iBAAiB;gBAClC0B;gBACAE,OAAOtB;gBACPc,cAAcX,QAAQW,YAAY;YACpC;YACA,IAAIO,KAAKN,MAAM,KAAK,GAAG;YAEvB,KAAK,MAAMQ,OAAOF,KAAM;gBACtBD,mBAAmBG,IAAIC,WAAW;gBAClC,IAAID,IAAIE,UAAU,KAAKvB,YAAYM,iBAAiB,EAAE;oBACpDS,WAAW;oBACXC,kBAAkB;oBAClB;gBACF;gBAEA,MAAMQ,eAAexB,YAAYyB,SAAS,CAACJ,IAAIC,WAAW,EAAED,IAAIK,UAAU,EAAEL,IAAIE,UAAU;gBAC1F,IAAI;oBACF,MAAMI,UAAU3B,YAAY4B,OAAO,CAACP,IAAIC,WAAW,EAAEE;oBACrD,MAAMK,UAAU,MAAMnC,qBAAqB;wBACzC4B,aAAaD,IAAIC,WAAW;wBAC5BQ,eAAeT,IAAIE,UAAU;wBAC7BG,YAAYC,QAAQD,UAAU;wBAC9BH,YAAYI,QAAQJ,UAAU;oBAChC;oBACA,IAAIM,SAASf,WAAW;yBACnB;wBACHC,WAAW;wBACXE,eAAe;oBACjB;gBACF,SAAU;oBACRO,aAAaO,IAAI,CAAC;gBACpB;YACF;QACF;QAEAnC,yBAAyB;YAACoC,SAAS;YAAWC,OAAOnB;QAAO;QAC5DlB,yBAAyB;YAACoC,SAAS;YAAmBC,OAAOjB;QAAc;QAC3EpB,yBAAyB;YAACoC,SAAS;YAAgBC,OAAOhB;QAAW;QACrErB,yBAAyB;YACvBoC,SAASE,wBAAwB;gBAACpB;gBAASE;gBAAgBC;YAAW;YACtEgB,OAAO;YACPE,YAAYhC,KAAKC,GAAG,KAAKF;QAC3B;QACA,OAAO;YAACY;YAASC;QAAO;IAC1B,EAAE,OAAOqB,OAAO;QACdxC,yBAAyB;YACvBoC,SAASrC,yBAAyByC;YAClCD,YAAYhC,KAAKC,GAAG,KAAKF;QAC3B;QACA,MAAMkC;IACR;AACF;AAEA,SAASF,wBAAwBG,MAIhC;IACC,IAAIA,OAAOvB,OAAO,GAAG,GAAG,OAAO;IAC/B,IAAIuB,OAAOpB,WAAW,GAAG,GAAG,OAAO;IACnC,IAAIoB,OAAOrB,cAAc,KAAK,GAAG,OAAO;IACxC,OAAO;AACT"}
+{"version":3,"sources":["../../src/core/rotate-kek.ts"],"sourcesContent":["import {rotateDataKeysWithTelemetry} from '@shipfox/node-envelope-encryption';\nimport {listDataKeysPage, listDataKeyVersions, updateDataKeyWrapCas} from '#db/index.js';\nimport {classifyKekRotationError, recordSecretsKekRotation} from '#metrics/instance.js';\nimport {KekVersionStrandedError} from './errors.js';\nimport type {KeyProvider} from './key-provider.js';\n\nexport interface RotateWorkspaceDataKeysResult {\n  rotated: number;\n  skipped: number;\n}\n\nexport interface RotateWorkspaceDataKeysOptions {\n  workspaceIds?: string[] | undefined;\n}\n\nexport function rotateWorkspaceDataKeysWithProvider(\n  keyProvider: KeyProvider,\n  options: RotateWorkspaceDataKeysOptions = {},\n): Promise<RotateWorkspaceDataKeysResult> {\n  return rotateDataKeysWithTelemetry({\n    keyProvider,\n    repository: {\n      listUnknownKeyVersions(knownVersions) {\n        return listDataKeyVersions(knownVersions, {workspaceIds: options.workspaceIds});\n      },\n      async listPage(params) {\n        const rows = await listDataKeysPage({\n          afterWorkspaceId: params.afterKeyId,\n          limit: params.limit,\n          workspaceIds: options.workspaceIds,\n        });\n        return rows.map((row) => ({keyId: row.workspaceId, ...row}));\n      },\n      updateWrapCas(params) {\n        return updateDataKeyWrapCas({\n          workspaceId: params.keyId,\n          oldKekVersion: params.oldKekVersion,\n          wrappedDek: params.wrappedDek,\n          kekVersion: params.kekVersion,\n        });\n      },\n    },\n    record: recordSecretsKekRotation,\n    classifyError: classifyKekRotationError,\n    strandedError: (keyVersion) => new KekVersionStrandedError(keyVersion),\n  });\n}\n"],"names":["rotateDataKeysWithTelemetry","listDataKeysPage","listDataKeyVersions","updateDataKeyWrapCas","classifyKekRotationError","recordSecretsKekRotation","KekVersionStrandedError","rotateWorkspaceDataKeysWithProvider","keyProvider","options","repository","listUnknownKeyVersions","knownVersions","workspaceIds","listPage","params","rows","afterWorkspaceId","afterKeyId","limit","map","row","keyId","workspaceId","updateWrapCas","oldKekVersion","wrappedDek","kekVersion","record","classifyError","strandedError","keyVersion"],"mappings":"AAAA,SAAQA,2BAA2B,QAAO,oCAAoC;AAC9E,SAAQC,gBAAgB,EAAEC,mBAAmB,EAAEC,oBAAoB,QAAO,eAAe;AACzF,SAAQC,wBAAwB,EAAEC,wBAAwB,QAAO,uBAAuB;AACxF,SAAQC,uBAAuB,QAAO,cAAc;AAYpD,OAAO,SAASC,oCACdC,WAAwB,EACxBC,UAA0C,CAAC,CAAC;IAE5C,OAAOT,4BAA4B;QACjCQ;QACAE,YAAY;YACVC,wBAAuBC,aAAa;gBAClC,OAAOV,oBAAoBU,eAAe;oBAACC,cAAcJ,QAAQI,YAAY;gBAAA;YAC/E;YACA,MAAMC,UAASC,MAAM;gBACnB,MAAMC,OAAO,MAAMf,iBAAiB;oBAClCgB,kBAAkBF,OAAOG,UAAU;oBACnCC,OAAOJ,OAAOI,KAAK;oBACnBN,cAAcJ,QAAQI,YAAY;gBACpC;gBACA,OAAOG,KAAKI,GAAG,CAAC,CAACC,MAAS,CAAA;wBAACC,OAAOD,IAAIE,WAAW;wBAAE,GAAGF,GAAG;oBAAA,CAAA;YAC3D;YACAG,eAAcT,MAAM;gBAClB,OAAOZ,qBAAqB;oBAC1BoB,aAAaR,OAAOO,KAAK;oBACzBG,eAAeV,OAAOU,aAAa;oBACnCC,YAAYX,OAAOW,UAAU;oBAC7BC,YAAYZ,OAAOY,UAAU;gBAC/B;YACF;QACF;QACAC,QAAQvB;QACRwB,eAAezB;QACf0B,eAAe,CAACC,aAAe,IAAIzB,wBAAwByB;IAC7D;AACF"}