@synoikia/core 0.1.0

package/dist/config/env.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { z } from 'zod';
+const here = path.dirname(fileURLToPath(import.meta.url));
+// src/config or dist/config → repository/workspace root is three levels up.
+const workspaceRoot = path.resolve(here, '../../../..');
+const bool = z
+    .enum(['true', 'false', '1', '0', ''])
+    .optional()
+    .transform((v) => v === 'true' || v === '1');
+const port = z.coerce.number().int().min(0).max(65535);
+const optionalUrl = z
+    .string()
+    .optional()
+    .transform((v) => (v ? v : undefined))
+    .pipe(z.url().optional());
+const EnvSchema = z
+    .object({
+    DATA_DIR: z.string().default('/data'),
+    MASTER_KEY: z.string().optional(),
+    MCP_HOST: z.string().default('0.0.0.0'),
+    MCP_PORT: port.default(8080),
+    ADMIN_HOST: z.string().default('0.0.0.0'),
+    ADMIN_PORT: port.default(8081),
+    PUBLIC_MCP_URL: optionalUrl,
+    PUBLIC_ADMIN_URL: optionalUrl,
+    /**
+     * How many reverse proxies in front of core to trust: `true`/`1` for one, `2` for two chained, and so
+     * on. X-Forwarded-For is read from the right, skipping only what those proxies appended.
+     */
+    TRUST_PROXY: z
+        .string()
+        .optional()
+        .transform((v, ctx) => {
+        const s = (v ?? '').trim().toLowerCase();
+        if (s === '' || s === 'false')
+            return 0;
+        if (s === 'true')
+            return 1;
+        if (/^\d+$/.test(s) && Number(s) <= 10)
+            return Number(s);
+        ctx.addIssue({ code: 'custom', message: 'TRUST_PROXY must be true, false or a hop count (0–10)' });
+        return z.NEVER;
+    }),
+    /**
+     * Extra host names the MCP listener answers to (comma-separated), besides PUBLIC_MCP_URL's host,
+     * localhost and IP addresses. Anything else is refused, which stops DNS rebinding.
+     */
+    MCP_ALLOWED_HOSTS: z
+        .string()
+        .optional()
+        .transform((v) => (v ?? '')
+        .split(',')
+        .map((h) => h.trim().toLowerCase())
+        .filter(Boolean)),
+    CORE_PLUGINS_AUTOENABLE: bool,
+    CORE_PLUGINS_DIR: z.string().default(path.join(workspaceRoot, 'plugins')),
+    ADMIN_UI_DIR: z.string().default(path.join(workspaceRoot, 'packages/admin-ui/dist')),
+    ADMIN_BOOTSTRAP_USERNAME: z.string().optional(),
+    ADMIN_BOOTSTRAP_PASSWORD: z.string().optional(),
+    ADMIN_FORCE_LOCAL_LOGIN: bool,
+    LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']).default('info'),
+})
+    .refine((e) => e.MCP_PORT === 0 || e.MCP_PORT !== e.ADMIN_PORT, {
+    message: 'MCP_PORT and ADMIN_PORT must differ',
+    path: ['ADMIN_PORT'],
+});
+export function loadConfig(env = process.env) {
+    return EnvSchema.parse(env);
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,4EAA4E;AAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC;KACX,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;KACrC,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AAE/C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvD,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KACrC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE5B,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACzC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,cAAc,EAAE,WAAW;IAC3B,gBAAgB,EAAE,WAAW;IAC7B;;;OAGG;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC,CAAC;IACJ;;;OAGG;IACH,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,IAAI,EAAE,CAAC;SACN,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CACnB;IACH,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACpF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/C,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/C,uBAAuB,EAAE,IAAI;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACtE,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,UAAU,EAAE;IAC9D,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC,CAAC;AAIL,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/crypto/index.d.ts

@@ -0,0 +1,28 @@
+export declare const MASTER_KEY_FILENAME = "master.key";
+export declare class DecryptionError extends Error {
+    constructor(message?: string);
+}
+/** Associated data for a stored secret, e.g. `aad('plugin_instances', 'secrets_enc', id)`. */
+export declare function aad(table: string, column: string, rowId: string): string;
+export declare class SecretBox {
+    private readonly key;
+    private constructor();
+    static fromKey(key: Buffer): SecretBox;
+    encrypt(plaintext: string | Buffer, associatedData: string): Buffer;
+    decrypt(blob: Buffer, associatedData: string): Buffer;
+    encryptJson(value: unknown, associatedData: string): Buffer;
+    decryptJson<T = unknown>(blob: Buffer, associatedData: string): T;
+    /** Purpose-bound subkeys (attestation HMAC, approval links, session pepper) via HKDF-SHA256. */
+    deriveKey(purpose: string, length?: number): Buffer;
+}
+export interface MasterKeyResult {
+    key: Buffer;
+    source: 'env' | 'file' | 'generated';
+    /** Set when the key lives in the data volume, which the design recommends against for production. */
+    warning?: string;
+}
+/** `MASTER_KEY` env wins; otherwise read or create `DATA_DIR/master.key` with mode 0600. */
+export declare function loadMasterKey(opts: {
+    envKey?: string;
+    dataDir: string;
+}): MasterKeyResult;

package/dist/crypto/index.js

@@ -0,0 +1,88 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * Application-level encryption for secrets at rest (design §7.2): AES-256-GCM with a random 96-bit
+ * nonce per value and associated data binding each ciphertext to its table/column/row.
+ */
+const VERSION = 0x01;
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+export const MASTER_KEY_FILENAME = 'master.key';
+export class DecryptionError extends Error {
+    constructor(message = 'Unable to decrypt value (wrong key, wrong row binding, or corrupted data)') {
+        super(message);
+        this.name = 'DecryptionError';
+    }
+}
+/** Associated data for a stored secret, e.g. `aad('plugin_instances', 'secrets_enc', id)`. */
+export function aad(table, column, rowId) {
+    return `${table}:${column}:${rowId}`;
+}
+export class SecretBox {
+    key;
+    constructor(key) {
+        this.key = key;
+    }
+    static fromKey(key) {
+        if (key.length !== KEY_BYTES)
+            throw new Error(`Master key must be ${KEY_BYTES} bytes, got ${key.length}`);
+        return new SecretBox(Buffer.from(key));
+    }
+    encrypt(plaintext, associatedData) {
+        const nonce = randomBytes(NONCE_BYTES);
+        const cipher = createCipheriv('aes-256-gcm', this.key, nonce);
+        cipher.setAAD(Buffer.from(associatedData, 'utf8'));
+        const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        return Buffer.concat([Buffer.of(VERSION), nonce, body, cipher.getAuthTag()]);
+    }
+    decrypt(blob, associatedData) {
+        if (blob.length < 1 + NONCE_BYTES + TAG_BYTES || blob[0] !== VERSION)
+            throw new DecryptionError();
+        const nonce = blob.subarray(1, 1 + NONCE_BYTES);
+        const tag = blob.subarray(blob.length - TAG_BYTES);
+        const body = blob.subarray(1 + NONCE_BYTES, blob.length - TAG_BYTES);
+        try {
+            const decipher = createDecipheriv('aes-256-gcm', this.key, nonce);
+            decipher.setAAD(Buffer.from(associatedData, 'utf8'));
+            decipher.setAuthTag(tag);
+            return Buffer.concat([decipher.update(body), decipher.final()]);
+        }
+        catch {
+            throw new DecryptionError();
+        }
+    }
+    encryptJson(value, associatedData) {
+        return this.encrypt(JSON.stringify(value), associatedData);
+    }
+    decryptJson(blob, associatedData) {
+        return JSON.parse(this.decrypt(blob, associatedData).toString('utf8'));
+    }
+    /** Purpose-bound subkeys (attestation HMAC, approval links, session pepper) via HKDF-SHA256. */
+    deriveKey(purpose, length = KEY_BYTES) {
+        return Buffer.from(hkdfSync('sha256', this.key, Buffer.alloc(0), `synoikia:${purpose}`, length));
+    }
+}
+function decodeKey(raw, origin) {
+    const key = Buffer.from(raw.trim(), 'base64');
+    if (key.length !== KEY_BYTES) {
+        throw new Error(`${origin} must be ${KEY_BYTES} bytes of base64 (e.g. \`openssl rand -base64 32\`)`);
+    }
+    return key;
+}
+/** `MASTER_KEY` env wins; otherwise read or create `DATA_DIR/master.key` with mode 0600. */
+export function loadMasterKey(opts) {
+    if (opts.envKey)
+        return { key: decodeKey(opts.envKey, 'MASTER_KEY'), source: 'env' };
+    const file = path.join(opts.dataDir, MASTER_KEY_FILENAME);
+    const warning = `Master key is stored at ${file}, inside the data volume. Set MASTER_KEY to keep it separate from the database.`;
+    if (existsSync(file))
+        return { key: decodeKey(readFileSync(file, 'utf8'), file), source: 'file', warning };
+    mkdirSync(opts.dataDir, { recursive: true });
+    const key = randomBytes(KEY_BYTES);
+    writeFileSync(file, `${key.toString('base64')}\n`, { mode: 0o600, flag: 'wx' });
+    chmodSync(file, 0o600);
+    return { key, source: 'generated', warning };
+}
+//# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AAEH,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,GAAG,2EAA2E;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,KAAa;IAC9D,OAAO,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,SAAS;IACiB;IAArC,YAAqC,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEpD,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,SAA0B,EAAE,cAAsB;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,cAAsB;QAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;YAAE,MAAM,IAAI,eAAe,EAAE,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;YACrD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,cAAsB;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED,WAAW,CAAc,IAAY,EAAE,cAAsB;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC9E,CAAC;IAED,gGAAgG;IAChG,SAAS,CAAC,OAAe,EAAE,MAAM,GAAG,SAAS;QAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACnG,CAAC;CACF;AASD,SAAS,SAAS,CAAC,GAAW,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,YAAY,SAAS,qDAAqD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,IAA0C;IACtE,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAErF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,2BAA2B,IAAI,iFAAiF,CAAC;IACjI,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3G,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,aAAa,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/crypto/rotate.d.ts

@@ -0,0 +1,15 @@
+import type { Db } from '../db/index.js';
+import type { SecretBox } from './index.js';
+/**
+ * Master-key rotation (design §7.2): re-encrypts every secret column under the new key in one
+ * transaction. Everything is decrypted first, so a wrong current key changes nothing. Sessions are
+ * cleared because their ids are peppered with a key derived from the master key.
+ */
+export interface RotationResult {
+    users: number;
+    oidc: number;
+    instances: number;
+    notifiers: number;
+    sessionsCleared: number;
+}
+export declare function rotateSecrets(db: Db, from: SecretBox, to: SecretBox): RotationResult;

package/dist/crypto/rotate.js

@@ -0,0 +1,61 @@
+import { eq } from 'drizzle-orm';
+import { notifierChannels, oidcConfig, pluginInstances, sessions, users } from '../db/schema.js';
+import { aad } from './index.js';
+export function rotateSecrets(db, from, to) {
+    const reencrypt = (blob, table, column, id) => {
+        const ad = aad(table, column, id);
+        return to.encrypt(from.decrypt(blob, ad), ad);
+    };
+    return db.transaction((tx) => {
+        const userRows = tx
+            .select()
+            .from(users)
+            .all()
+            .filter((u) => u.totpSecretEnc);
+        const oidcRows = tx
+            .select()
+            .from(oidcConfig)
+            .all()
+            .filter((o) => o.clientSecretEnc);
+        const instanceRows = tx
+            .select()
+            .from(pluginInstances)
+            .all()
+            .filter((i) => i.secretsEnc);
+        const notifierRows = tx
+            .select()
+            .from(notifierChannels)
+            .all()
+            .filter((n) => n.secretsEnc);
+        // Decrypt-and-re-encrypt everything before writing anything.
+        const updates = [
+            ...userRows.map((u) => {
+                const v = reencrypt(u.totpSecretEnc, 'users', 'totp_secret_enc', u.id);
+                return () => tx.update(users).set({ totpSecretEnc: v }).where(eq(users.id, u.id)).run();
+            }),
+            ...oidcRows.map((o) => {
+                const v = reencrypt(o.clientSecretEnc, 'oidc_config', 'client_secret_enc', String(o.id));
+                return () => tx.update(oidcConfig).set({ clientSecretEnc: v }).where(eq(oidcConfig.id, o.id)).run();
+            }),
+            ...instanceRows.map((i) => {
+                const v = reencrypt(i.secretsEnc, 'plugin_instances', 'secrets_enc', i.id);
+                return () => tx.update(pluginInstances).set({ secretsEnc: v }).where(eq(pluginInstances.id, i.id)).run();
+            }),
+            ...notifierRows.map((n) => {
+                const v = reencrypt(n.secretsEnc, 'notifier_channels', 'secrets_enc', n.id);
+                return () => tx.update(notifierChannels).set({ secretsEnc: v }).where(eq(notifierChannels.id, n.id)).run();
+            }),
+        ];
+        for (const apply of updates)
+            apply();
+        const sessionsCleared = tx.delete(sessions).run().changes;
+        return {
+            users: userRows.length,
+            oidc: oidcRows.length,
+            instances: instanceRows.length,
+            notifiers: notifierRows.length,
+            sessionsCleared,
+        };
+    });
+}
+//# sourceMappingURL=rotate.js.map

package/dist/crypto/rotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.js","sourceRoot":"","sources":["../../src/crypto/rotate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAiBjC,MAAM,UAAU,aAAa,CAAC,EAAM,EAAE,IAAe,EAAE,EAAa;IAClE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,EAAU,EAAE,EAAE;QAC5E,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,GAAG,EAAE;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,GAAG,EAAE;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,GAAG,EAAE;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,GAAG,EAAE;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAE/B,6DAA6D;QAC7D,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,aAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxE,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1F,CAAC,CAAC;YACF,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,eAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1F,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,CAAC,CAAC;YACF,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5E,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3G,CAAC,CAAC;YACF,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7E,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7G,CAAC,CAAC;SACH,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,KAAK,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,SAAS,EAAE,YAAY,CAAC,MAAM;YAC9B,SAAS,EAAE,YAAY,CAAC,MAAM;YAC9B,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/db/index.d.ts

@@ -0,0 +1,17 @@
+import Database from 'better-sqlite3';
+import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import * as schema from './schema.js';
+export type Db = BetterSQLite3Database<typeof schema> & {
+    $client: Database.Database;
+};
+/** A transaction handle; services accept either so callers can compose them in one transaction. */
+export type Tx = Parameters<Parameters<Db['transaction']>[0]>[0];
+export type DbLike = Db | Tx;
+export declare const DB_FILENAME = "synoikia.sqlite";
+/**
+ * Opens (creating if needed) the single SQLite database and applies pending migrations
+ * (design §7). Pass `':memory:'` for tests.
+ */
+export declare function openDatabase(location: {
+    dataDir: string;
+} | ':memory:'): Db;

package/dist/db/index.js

@@ -0,0 +1,29 @@
+import { mkdirSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Database from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+import { migrate } from 'drizzle-orm/better-sqlite3/migrator';
+import * as schema from './schema.js';
+// src/db or dist/db → packages/core/drizzle
+const MIGRATIONS_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../drizzle');
+export const DB_FILENAME = 'synoikia.sqlite';
+/**
+ * Opens (creating if needed) the single SQLite database and applies pending migrations
+ * (design §7). Pass `':memory:'` for tests.
+ */
+export function openDatabase(location) {
+    let file = ':memory:';
+    if (location !== ':memory:') {
+        mkdirSync(location.dataDir, { recursive: true });
+        file = path.join(location.dataDir, DB_FILENAME);
+    }
+    const sqlite = new Database(file);
+    sqlite.pragma('journal_mode = WAL');
+    sqlite.pragma('foreign_keys = ON');
+    sqlite.pragma('busy_timeout = 5000');
+    const db = drizzle(sqlite, { schema });
+    migrate(db, { migrationsFolder: MIGRATIONS_DIR });
+    return db;
+}
+//# sourceMappingURL=index.js.map

package/dist/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAOtC,4CAA4C;AAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAEnG,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAA0C;IACrE,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC;AACZ,CAAC"}