@undefineds.co/xpod 0.3.58 → 0.3.61

package/dist/runtime/safe-env.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AMBIENT_AI_PROVIDER_ENV_KEYS = void 0;
+exports.sanitizeRuntimeEnv = sanitizeRuntimeEnv;
+exports.requireAiConnectionRuntimeConfig = requireAiConnectionRuntimeConfig;
+exports.projectAiConnectionEnv = projectAiConnectionEnv;
+exports.projectOpenAiCompatibleEnv = projectOpenAiCompatibleEnv;
+exports.projectAnthropicCompatibleEnv = projectAnthropicCompatibleEnv;
+exports.AMBIENT_AI_PROVIDER_ENV_KEYS = [
+    'AI_CONNECTION_API_KEY',
+    'AI_CONNECTION_BASE_URL',
+    'OPENAI_API_KEY',
+    'OPENAI_BASE_URL',
+    'OPENAI_API_BASE',
+    'OPENAI_ORG_ID',
+    'OPENAI_ORGANIZATION',
+    'OPENAI_PROJECT',
+    'OPENAI_MODEL',
+    'CODEX_API_KEY',
+    'CODEX_MODEL',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+    'ANTHROPIC_BASE_URL',
+    'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+    'ANTHROPIC_DEFAULT_OPUS_MODEL',
+    'DEFAULT_API_KEY',
+    'DEFAULT_API_BASE',
+    'DEFAULT_PROVIDER',
+    'DEFAULT_MODEL',
+];
+const AMBIENT_AI_PROVIDER_ENV_KEY_SET = new Set(exports.AMBIENT_AI_PROVIDER_ENV_KEYS);
+const AMBIENT_AI_PROVIDER_ENV_KEY_PATTERNS = [
+    /^ANTHROPIC_DEFAULT_[A-Z0-9_]*MODEL$/u,
+];
+function sanitizeRuntimeEnv(source = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (typeof value === 'string' && !isAmbientAiProviderEnvKey(key)) {
+            env[key] = value;
+        }
+    }
+    return env;
+}
+function isAmbientAiProviderEnvKey(key) {
+    return AMBIENT_AI_PROVIDER_ENV_KEY_SET.has(key) ||
+        AMBIENT_AI_PROVIDER_ENV_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+function requireAiConnectionRuntimeConfig(input, context) {
+    const baseUrl = input.baseUrl?.trim();
+    if (!baseUrl) {
+        throw new Error(`${context} requires AI Connection baseUrl`);
+    }
+    const apiKey = input.apiKey?.trim();
+    if (!apiKey) {
+        throw new Error(`${context} requires AI Connection API key`);
+    }
+    const model = input.model?.trim();
+    return {
+        baseUrl,
+        apiKey,
+        ...(model ? { model } : {}),
+    };
+}
+function projectAiConnectionEnv(config) {
+    return {
+        AI_CONNECTION_BASE_URL: config.baseUrl,
+        AI_CONNECTION_API_KEY: config.apiKey,
+    };
+}
+function projectOpenAiCompatibleEnv(config) {
+    return {
+        ...projectAiConnectionEnv(config),
+        OPENAI_BASE_URL: config.baseUrl,
+        OPENAI_API_BASE: config.baseUrl,
+        OPENAI_API_KEY: config.apiKey,
+        CODEX_API_KEY: config.apiKey,
+        ...(config.model ? {
+            OPENAI_MODEL: config.model,
+            CODEX_MODEL: config.model,
+        } : {}),
+    };
+}
+function projectAnthropicCompatibleEnv(config) {
+    const baseUrl = normalizeMessagesCompatibleBaseUrl(config.baseUrl);
+    const isOpenRouterLike = baseUrl.includes('openrouter.ai');
+    return {
+        ...projectAiConnectionEnv(config),
+        ANTHROPIC_BASE_URL: baseUrl,
+        ...(isOpenRouterLike
+            ? { ANTHROPIC_AUTH_TOKEN: config.apiKey }
+            : { ANTHROPIC_API_KEY: config.apiKey }),
+        ...(config.model ? {
+            ANTHROPIC_DEFAULT_SONNET_MODEL: config.model,
+            ANTHROPIC_DEFAULT_HAIKU_MODEL: config.model,
+            ANTHROPIC_DEFAULT_OPUS_MODEL: config.model,
+        } : {}),
+    };
+}
+function normalizeMessagesCompatibleBaseUrl(baseUrl) {
+    if (baseUrl.endsWith('/v1')) {
+        return baseUrl.slice(0, -3);
+    }
+    if (baseUrl.endsWith('/v1/')) {
+        return baseUrl.slice(0, -4);
+    }
+    return baseUrl;
+}
+//# sourceMappingURL=safe-env.js.map

package/dist/runtime/safe-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-env.js","sourceRoot":"","sources":["../../src/runtime/safe-env.ts"],"names":[],"mappings":";;;AAmCA,gDAUC;AAOD,4EAsBC;AAED,wDAKC;AAED,gEAYC;AAED,sEAeC;AAhHY,QAAA,4BAA4B,GAAG;IAC1C,uBAAuB;IACvB,wBAAwB;IACxB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;CACP,CAAC;AAEX,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAS,oCAA4B,CAAC,CAAC;AACtF,MAAM,oCAAoC,GAAG;IAC3C,sCAAsC;CAC9B,CAAC;AAQX,SAAgB,kBAAkB,CAChC,SAAiE,OAAO,CAAC,GAAG;IAE5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,OAAO,+BAA+B,CAAC,GAAG,CAAC,GAAkD,CAAC;QAC5F,oCAAoC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,gCAAgC,CAC9C,KAIC,EACD,OAAe;IAEf,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,OAAO;QACL,OAAO;QACP,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAiC;IACtE,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,OAAO;QACtC,qBAAqB,EAAE,MAAM,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,MAAiC;IAC1E,OAAO;QACL,GAAG,sBAAsB,CAAC,MAAM,CAAC;QACjC,eAAe,EAAE,MAAM,CAAC,OAAO;QAC/B,eAAe,EAAE,MAAM,CAAC,OAAO;QAC/B,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,WAAW,EAAE,MAAM,CAAC,KAAK;SAC1B,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAAC,MAAiC;IAC7E,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3D,OAAO;QACL,GAAG,sBAAsB,CAAC,MAAM,CAAC;QACjC,kBAAkB,EAAE,OAAO;QAC3B,GAAG,CAAC,gBAAgB;YAClB,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE;YACzC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,8BAA8B,EAAE,MAAM,CAAC,KAAK;YAC5C,6BAA6B,EAAE,MAAM,CAAC,KAAK;YAC3C,4BAA4B,EAAE,MAAM,CAAC,KAAK;SAC3C,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAe;IACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["export const AMBIENT_AI_PROVIDER_ENV_KEYS = [\n  'AI_CONNECTION_API_KEY',\n  'AI_CONNECTION_BASE_URL',\n  'OPENAI_API_KEY',\n  'OPENAI_BASE_URL',\n  'OPENAI_API_BASE',\n  'OPENAI_ORG_ID',\n  'OPENAI_ORGANIZATION',\n  'OPENAI_PROJECT',\n  'OPENAI_MODEL',\n  'CODEX_API_KEY',\n  'CODEX_MODEL',\n  'ANTHROPIC_API_KEY',\n  'ANTHROPIC_AUTH_TOKEN',\n  'ANTHROPIC_BASE_URL',\n  'ANTHROPIC_DEFAULT_SONNET_MODEL',\n  'ANTHROPIC_DEFAULT_HAIKU_MODEL',\n  'ANTHROPIC_DEFAULT_OPUS_MODEL',\n  'DEFAULT_API_KEY',\n  'DEFAULT_API_BASE',\n  'DEFAULT_PROVIDER',\n  'DEFAULT_MODEL',\n] as const;\n\nconst AMBIENT_AI_PROVIDER_ENV_KEY_SET = new Set<string>(AMBIENT_AI_PROVIDER_ENV_KEYS);\nconst AMBIENT_AI_PROVIDER_ENV_KEY_PATTERNS = [\n  /^ANTHROPIC_DEFAULT_[A-Z0-9_]*MODEL$/u,\n] as const;\n\nexport interface AiConnectionRuntimeConfig {\n  baseUrl: string;\n  apiKey: string;\n  model?: string;\n}\n\nexport function sanitizeRuntimeEnv(\n  source: NodeJS.ProcessEnv | Record<string, string | undefined> = process.env,\n): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const [key, value] of Object.entries(source)) {\n    if (typeof value === 'string' && !isAmbientAiProviderEnvKey(key)) {\n      env[key] = value;\n    }\n  }\n  return env;\n}\n\nfunction isAmbientAiProviderEnvKey(key: string): boolean {\n  return AMBIENT_AI_PROVIDER_ENV_KEY_SET.has(key as typeof AMBIENT_AI_PROVIDER_ENV_KEYS[number]) ||\n    AMBIENT_AI_PROVIDER_ENV_KEY_PATTERNS.some((pattern) => pattern.test(key));\n}\n\nexport function requireAiConnectionRuntimeConfig(\n  input: {\n    baseUrl?: string;\n    apiKey?: string;\n    model?: string;\n  },\n  context: string,\n): AiConnectionRuntimeConfig {\n  const baseUrl = input.baseUrl?.trim();\n  if (!baseUrl) {\n    throw new Error(`${context} requires AI Connection baseUrl`);\n  }\n  const apiKey = input.apiKey?.trim();\n  if (!apiKey) {\n    throw new Error(`${context} requires AI Connection API key`);\n  }\n  const model = input.model?.trim();\n  return {\n    baseUrl,\n    apiKey,\n    ...(model ? { model } : {}),\n  };\n}\n\nexport function projectAiConnectionEnv(config: AiConnectionRuntimeConfig): Record<string, string> {\n  return {\n    AI_CONNECTION_BASE_URL: config.baseUrl,\n    AI_CONNECTION_API_KEY: config.apiKey,\n  };\n}\n\nexport function projectOpenAiCompatibleEnv(config: AiConnectionRuntimeConfig): Record<string, string> {\n  return {\n    ...projectAiConnectionEnv(config),\n    OPENAI_BASE_URL: config.baseUrl,\n    OPENAI_API_BASE: config.baseUrl,\n    OPENAI_API_KEY: config.apiKey,\n    CODEX_API_KEY: config.apiKey,\n    ...(config.model ? {\n      OPENAI_MODEL: config.model,\n      CODEX_MODEL: config.model,\n    } : {}),\n  };\n}\n\nexport function projectAnthropicCompatibleEnv(config: AiConnectionRuntimeConfig): Record<string, string> {\n  const baseUrl = normalizeMessagesCompatibleBaseUrl(config.baseUrl);\n  const isOpenRouterLike = baseUrl.includes('openrouter.ai');\n  return {\n    ...projectAiConnectionEnv(config),\n    ANTHROPIC_BASE_URL: baseUrl,\n    ...(isOpenRouterLike\n      ? { ANTHROPIC_AUTH_TOKEN: config.apiKey }\n      : { ANTHROPIC_API_KEY: config.apiKey }),\n    ...(config.model ? {\n      ANTHROPIC_DEFAULT_SONNET_MODEL: config.model,\n      ANTHROPIC_DEFAULT_HAIKU_MODEL: config.model,\n      ANTHROPIC_DEFAULT_OPUS_MODEL: config.model,\n    } : {}),\n  };\n}\n\nfunction normalizeMessagesCompatibleBaseUrl(baseUrl: string): string {\n  if (baseUrl.endsWith('/v1')) {\n    return baseUrl.slice(0, -3);\n  }\n  if (baseUrl.endsWith('/v1/')) {\n    return baseUrl.slice(0, -4);\n  }\n  return baseUrl;\n}\n"]}

package/dist/security/index.d.ts

@@ -0,0 +1 @@
+export * from './secret-cell';

package/dist/security/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./secret-cell"), exports);
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B","sourcesContent":["export * from './secret-cell';\n"]}

package/dist/security/secret-cell/DeploymentRootKeyProvider.d.ts

@@ -0,0 +1,17 @@
+export interface RootKeyMaterial {
+    keyId: string;
+    key: Uint8Array;
+}
+export interface DeploymentRootKeyProviderOptions {
+    activeKeyId: string;
+    keys: Record<string, Uint8Array>;
+}
+export declare class DeploymentRootKeyProvider {
+    private readonly activeKeyId;
+    private readonly keys;
+    constructor(options: DeploymentRootKeyProviderOptions);
+    getActiveKey(): RootKeyMaterial;
+    getActiveKeyId(): string;
+    getKey(keyId: string): RootKeyMaterial | undefined;
+}
+export declare function parseDeploymentRootKeyConfig(value: string): Uint8Array;

package/dist/security/secret-cell/DeploymentRootKeyProvider.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeploymentRootKeyProvider = void 0;
+exports.parseDeploymentRootKeyConfig = parseDeploymentRootKeyConfig;
+class DeploymentRootKeyProvider {
+    constructor(options) {
+        this.keys = new Map();
+        if (!options.activeKeyId) {
+            throw new Error('SecretCell active keyId is required');
+        }
+        for (const [keyId, key] of Object.entries(options.keys)) {
+            if (!keyId) {
+                throw new Error('SecretCell keyId is required');
+            }
+            if (key.byteLength !== 32) {
+                throw new Error(`SecretCell root key ${keyId} must be 32 bytes`);
+            }
+            this.keys.set(keyId, new Uint8Array(key));
+        }
+        if (!this.keys.has(options.activeKeyId)) {
+            throw new Error(`SecretCell active root key ${options.activeKeyId} is not configured`);
+        }
+        this.activeKeyId = options.activeKeyId;
+    }
+    getActiveKey() {
+        const key = this.keys.get(this.activeKeyId);
+        if (!key) {
+            throw new Error('SecretCell active root key is not available');
+        }
+        return { keyId: this.activeKeyId, key: new Uint8Array(key) };
+    }
+    getActiveKeyId() {
+        return this.activeKeyId;
+    }
+    getKey(keyId) {
+        const key = this.keys.get(keyId);
+        return key ? { keyId, key: new Uint8Array(key) } : undefined;
+    }
+}
+exports.DeploymentRootKeyProvider = DeploymentRootKeyProvider;
+function parseDeploymentRootKeyConfig(value) {
+    if (!isStrictBase64(value)) {
+        throw new Error('SecretCell root key must be strict base64');
+    }
+    const decoded = new Uint8Array(Buffer.from(value, 'base64'));
+    if (decoded.byteLength !== 32) {
+        decoded.fill(0);
+        throw new Error('SecretCell root key must decode to 32 bytes');
+    }
+    return decoded;
+}
+function isStrictBase64(value) {
+    if (value.length === 0 || value.length % 4 !== 0) {
+        return false;
+    }
+    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        return false;
+    }
+    return Buffer.from(value, 'base64').toString('base64') === value;
+}
+//# sourceMappingURL=DeploymentRootKeyProvider.js.map

package/dist/security/secret-cell/DeploymentRootKeyProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeploymentRootKeyProvider.js","sourceRoot":"","sources":["../../../src/security/secret-cell/DeploymentRootKeyProvider.ts"],"names":[],"mappings":";;;AAmDA,oEAUC;AAnDD,MAAa,yBAAyB;IAIpC,YAAmB,OAAyC;QAF3C,SAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAGpD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,mBAAmB,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,WAAW,oBAAoB,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;IAEM,YAAY;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,CAAC;IAEM,cAAc;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEM,MAAM,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;CACF;AAvCD,8DAuCC;AAED,SAAgB,4BAA4B,CAAC,KAAa;IACxD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC;AACnE,CAAC","sourcesContent":["export interface RootKeyMaterial {\n  keyId: string;\n  key: Uint8Array;\n}\n\nexport interface DeploymentRootKeyProviderOptions {\n  activeKeyId: string;\n  keys: Record<string, Uint8Array>;\n}\n\nexport class DeploymentRootKeyProvider {\n  private readonly activeKeyId: string;\n  private readonly keys = new Map<string, Uint8Array>();\n\n  public constructor(options: DeploymentRootKeyProviderOptions) {\n    if (!options.activeKeyId) {\n      throw new Error('SecretCell active keyId is required');\n    }\n    for (const [keyId, key] of Object.entries(options.keys)) {\n      if (!keyId) {\n        throw new Error('SecretCell keyId is required');\n      }\n      if (key.byteLength !== 32) {\n        throw new Error(`SecretCell root key ${keyId} must be 32 bytes`);\n      }\n      this.keys.set(keyId, new Uint8Array(key));\n    }\n    if (!this.keys.has(options.activeKeyId)) {\n      throw new Error(`SecretCell active root key ${options.activeKeyId} is not configured`);\n    }\n    this.activeKeyId = options.activeKeyId;\n  }\n\n  public getActiveKey(): RootKeyMaterial {\n    const key = this.keys.get(this.activeKeyId);\n    if (!key) {\n      throw new Error('SecretCell active root key is not available');\n    }\n    return { keyId: this.activeKeyId, key: new Uint8Array(key) };\n  }\n\n  public getActiveKeyId(): string {\n    return this.activeKeyId;\n  }\n\n  public getKey(keyId: string): RootKeyMaterial | undefined {\n    const key = this.keys.get(keyId);\n    return key ? { keyId, key: new Uint8Array(key) } : undefined;\n  }\n}\n\nexport function parseDeploymentRootKeyConfig(value: string): Uint8Array {\n  if (!isStrictBase64(value)) {\n    throw new Error('SecretCell root key must be strict base64');\n  }\n  const decoded = new Uint8Array(Buffer.from(value, 'base64'));\n  if (decoded.byteLength !== 32) {\n    decoded.fill(0);\n    throw new Error('SecretCell root key must decode to 32 bytes');\n  }\n  return decoded;\n}\n\nfunction isStrictBase64(value: string): boolean {\n  if (value.length === 0 || value.length % 4 !== 0) {\n    return false;\n  }\n  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {\n    return false;\n  }\n  return Buffer.from(value, 'base64').toString('base64') === value;\n}\n"]}

package/dist/security/secret-cell/DeploymentRootKeyProvider.jsonld

@@ -0,0 +1,124 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider",
+      "@type": "Class",
+      "requireElement": "DeploymentRootKeyProvider",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_activeKeyId",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys",
+          "range": {
+            "@type": "ParameterRangeCollectEntries",
+            "parameterRangeCollectEntriesParameters": [
+              {
+                "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys_key"
+              },
+              {
+                "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys_value",
+                "range": {
+                  "@type": "ParameterRangeWildcard"
+                }
+              }
+            ]
+          }
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider__member_activeKeyId",
+          "memberFieldName": "activeKeyId"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider__member_keys",
+          "memberFieldName": "keys"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider__member_getActiveKey",
+          "memberFieldName": "getActiveKey"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider__member_getActiveKeyId",
+          "memberFieldName": "getActiveKeyId"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider__member_getKey",
+          "memberFieldName": "getKey"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "activeKeyId",
+              "value": {
+                "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_activeKeyId"
+              }
+            },
+            {
+              "keyRaw": "keys",
+              "value": {
+                "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys__constructorArgument",
+                "fields": [
+                  {
+                    "collectEntries": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys",
+                    "key": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys_key",
+                    "value": {
+                      "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProvider_options_keys_value"
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProviderOptions",
+      "@type": "AbstractClass",
+      "requireElement": "DeploymentRootKeyProviderOptions",
+      "parameters": [],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProviderOptions__member_activeKeyId",
+          "memberFieldName": "activeKeyId"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#DeploymentRootKeyProviderOptions__member_keys",
+          "memberFieldName": "keys"
+        }
+      ],
+      "constructorArguments": []
+    },
+    {
+      "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#RootKeyMaterial",
+      "@type": "AbstractClass",
+      "requireElement": "RootKeyMaterial",
+      "parameters": [],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#RootKeyMaterial__member_keyId",
+          "memberFieldName": "keyId"
+        },
+        {
+          "@id": "undefineds:dist/security/secret-cell/DeploymentRootKeyProvider.jsonld#RootKeyMaterial__member_key",
+          "memberFieldName": "key"
+        }
+      ],
+      "constructorArguments": []
+    }
+  ]
+}

package/dist/security/secret-cell/SecretCellVault.d.ts

@@ -0,0 +1,55 @@
+import type { DeploymentRootKeyProvider } from './DeploymentRootKeyProvider';
+declare const AES_GCM_ALGORITHM: "AES-256-GCM";
+declare const PAYLOAD_AAD_PURPOSE = "xpod.secret-cell.payload";
+declare const DEK_WRAP_AAD_PURPOSE = "xpod.secret-cell.dek-wrap";
+declare const AAD_VERSION = "v1";
+declare const DEK_WRAP_ALGORITHM = "xpod-secret-cell-root-hkdf-aes-256-gcm";
+export interface SecretCellContext {
+    ownerWebId: string;
+    resourceIri: string;
+    predicate: string;
+    field: string;
+    schemaVersion: string;
+    provider?: string;
+    extra?: Record<string, string>;
+}
+export interface SecretCellWrappedDataKey {
+    algorithm: typeof DEK_WRAP_ALGORITHM;
+    keyId: string;
+    aadPurpose: typeof DEK_WRAP_AAD_PURPOSE;
+    aadVersion: typeof AAD_VERSION;
+    nonce: string;
+    ciphertext: string;
+}
+export interface SecretCellEnvelope {
+    algorithm: typeof AES_GCM_ALGORITHM;
+    aadPurpose: typeof PAYLOAD_AAD_PURPOSE;
+    aadVersion: typeof AAD_VERSION;
+    context: SecretCellContext;
+    nonce: string;
+    ciphertext: string;
+    wrappedDek: SecretCellWrappedDataKey;
+}
+export interface SecretCellVaultOptions {
+    rootKeys: DeploymentRootKeyProvider;
+}
+export declare class SecretCellError extends Error {
+    constructor();
+    toJSON(): {
+        name: string;
+        message: string;
+    };
+}
+export declare class SecretCellVault {
+    private readonly rootKeys;
+    constructor(options: SecretCellVaultOptions);
+    needsRewrap(keyId: string): boolean;
+    seal(plaintext: Uint8Array, context: SecretCellContext): Promise<SecretCellEnvelope>;
+    open(envelope: SecretCellEnvelope, context: SecretCellContext): Promise<Uint8Array>;
+    rewrap(envelope: SecretCellEnvelope, context: SecretCellContext): Promise<SecretCellEnvelope>;
+    wrapDataKey(dek: Uint8Array, context: SecretCellContext): Promise<SecretCellWrappedDataKey>;
+    unwrapDataKey(wrapped: SecretCellWrappedDataKey, context: SecretCellContext): Promise<Uint8Array>;
+    private assertEnvelopeContext;
+}
+export declare function normalizeContext(context: SecretCellContext): SecretCellContext;
+export {};

package/dist/security/secret-cell/SecretCellVault.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretCellVault = exports.SecretCellError = void 0;
+exports.normalizeContext = normalizeContext;
+const node_crypto_1 = require("node:crypto");
+const TEXT_ENCODER = new TextEncoder();
+const AES_GCM_ALGORITHM = 'AES-256-GCM';
+const DEK_BYTES = 32;
+const NONCE_BYTES = 12;
+const PAYLOAD_AAD_PURPOSE = 'xpod.secret-cell.payload';
+const DEK_WRAP_AAD_PURPOSE = 'xpod.secret-cell.dek-wrap';
+const AAD_VERSION = 'v1';
+const DEK_WRAP_ALGORITHM = 'xpod-secret-cell-root-hkdf-aes-256-gcm';
+class SecretCellError extends Error {
+    constructor() {
+        super('Secret cell operation failed');
+        this.name = 'SecretCellError';
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            message: this.message,
+        };
+    }
+}
+exports.SecretCellError = SecretCellError;
+class SecretCellVault {
+    constructor(options) {
+        this.rootKeys = options.rootKeys;
+    }
+    needsRewrap(keyId) {
+        return keyId !== this.rootKeys.getActiveKeyId();
+    }
+    async seal(plaintext, context) {
+        const normalizedContext = normalizeContext(context);
+        const dek = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(DEK_BYTES));
+        const nonce = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+        try {
+            const key = await importAesGcmKey(dek, ['encrypt']);
+            const ciphertext = new Uint8Array(await node_crypto_1.webcrypto.subtle.encrypt({
+                name: 'AES-GCM',
+                iv: nonce,
+                additionalData: payloadAad(normalizedContext),
+            }, key, toArrayBuffer(plaintext)));
+            return {
+                algorithm: AES_GCM_ALGORITHM,
+                aadPurpose: PAYLOAD_AAD_PURPOSE,
+                aadVersion: AAD_VERSION,
+                context: normalizedContext,
+                nonce: encodeBase64Url(nonce),
+                ciphertext: encodeBase64Url(ciphertext),
+                wrappedDek: await this.wrapDataKey(dek, normalizedContext),
+            };
+        }
+        catch (_error) {
+            throw new SecretCellError();
+        }
+        finally {
+            dek.fill(0);
+        }
+    }
+    async open(envelope, context) {
+        let dek;
+        try {
+            const normalizedContext = this.assertEnvelopeContext(envelope, context);
+            dek = await this.unwrapDataKey(envelope.wrappedDek, normalizedContext);
+            const key = await importAesGcmKey(dek, ['decrypt']);
+            const plaintext = await node_crypto_1.webcrypto.subtle.decrypt({
+                name: 'AES-GCM',
+                iv: decodeBase64Url(envelope.nonce),
+                additionalData: payloadAad(normalizedContext),
+            }, key, decodeBase64Url(envelope.ciphertext));
+            return new Uint8Array(plaintext);
+        }
+        catch (_error) {
+            throw new SecretCellError();
+        }
+        finally {
+            dek?.fill(0);
+        }
+    }
+    async rewrap(envelope, context) {
+        let dek;
+        try {
+            const normalizedContext = this.assertEnvelopeContext(envelope, context);
+            dek = await this.unwrapDataKey(envelope.wrappedDek, normalizedContext);
+            return {
+                ...envelope,
+                wrappedDek: await this.wrapDataKey(dek, normalizedContext),
+            };
+        }
+        catch (_error) {
+            throw new SecretCellError();
+        }
+        finally {
+            dek?.fill(0);
+        }
+    }
+    async wrapDataKey(dek, context) {
+        const normalizedContext = normalizeContext(context);
+        const active = this.rootKeys.getActiveKey();
+        const nonce = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+        try {
+            const key = await deriveRootWrapKey(active.key, active.keyId);
+            const ciphertext = new Uint8Array(await node_crypto_1.webcrypto.subtle.encrypt({
+                name: 'AES-GCM',
+                iv: nonce,
+                additionalData: dekWrapAad(normalizedContext, active.keyId),
+            }, key, toArrayBuffer(dek)));
+            return {
+                algorithm: DEK_WRAP_ALGORITHM,
+                keyId: active.keyId,
+                aadPurpose: DEK_WRAP_AAD_PURPOSE,
+                aadVersion: AAD_VERSION,
+                nonce: encodeBase64Url(nonce),
+                ciphertext: encodeBase64Url(ciphertext),
+            };
+        }
+        catch (_error) {
+            throw new SecretCellError();
+        }
+        finally {
+            active.key.fill(0);
+        }
+    }
+    async unwrapDataKey(wrapped, context) {
+        try {
+            if (wrapped.algorithm !== DEK_WRAP_ALGORITHM
+                || wrapped.aadPurpose !== DEK_WRAP_AAD_PURPOSE
+                || wrapped.aadVersion !== AAD_VERSION) {
+                throw new Error('SecretCell wrapped DEK domain mismatch');
+            }
+            const root = this.rootKeys.getKey(wrapped.keyId);
+            if (!root) {
+                throw new Error('SecretCell root key is not configured');
+            }
+            try {
+                const key = await deriveRootWrapKey(root.key, root.keyId);
+                const dek = await node_crypto_1.webcrypto.subtle.decrypt({
+                    name: 'AES-GCM',
+                    iv: decodeBase64Url(wrapped.nonce),
+                    additionalData: dekWrapAad(normalizeContext(context), root.keyId),
+                }, key, decodeBase64Url(wrapped.ciphertext));
+                return new Uint8Array(dek);
+            }
+            finally {
+                root.key.fill(0);
+            }
+        }
+        catch (_error) {
+            throw new SecretCellError();
+        }
+    }
+    assertEnvelopeContext(envelope, context) {
+        const normalizedContext = normalizeContext(context);
+        if (envelope.algorithm !== AES_GCM_ALGORITHM
+            || envelope.aadPurpose !== PAYLOAD_AAD_PURPOSE
+            || envelope.aadVersion !== AAD_VERSION
+            || canonicalJson(normalizeContext(envelope.context)) !== canonicalJson(normalizedContext)) {
+            throw new Error('SecretCell envelope context mismatch');
+        }
+        return normalizedContext;
+    }
+}
+exports.SecretCellVault = SecretCellVault;
+async function importAesGcmKey(keyMaterial, usages) {
+    return await node_crypto_1.webcrypto.subtle.importKey('raw', toArrayBuffer(keyMaterial), { name: 'AES-GCM', length: 256 }, false, usages);
+}
+async function deriveRootWrapKey(rootKey, keyId) {
+    const hkdfKey = await node_crypto_1.webcrypto.subtle.importKey('raw', toArrayBuffer(rootKey), 'HKDF', false, ['deriveKey']);
+    return await node_crypto_1.webcrypto.subtle.deriveKey({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: TEXT_ENCODER.encode(`xpod.secret-cell.root.${keyId}`),
+        info: TEXT_ENCODER.encode(`${DEK_WRAP_AAD_PURPOSE}.${AAD_VERSION}`),
+    }, hkdfKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+function payloadAad(context) {
+    return TEXT_ENCODER.encode(canonicalJson({
+        purpose: PAYLOAD_AAD_PURPOSE,
+        version: AAD_VERSION,
+        context,
+    }));
+}
+function dekWrapAad(context, keyId) {
+    return TEXT_ENCODER.encode(canonicalJson({
+        purpose: DEK_WRAP_AAD_PURPOSE,
+        version: AAD_VERSION,
+        keyId,
+        context,
+    }));
+}
+function normalizeContext(context) {
+    const normalized = {
+        ownerWebId: requireContextField(context.ownerWebId, 'ownerWebId'),
+        resourceIri: requireContextField(context.resourceIri, 'resourceIri'),
+        predicate: requireContextField(context.predicate, 'predicate'),
+        field: requireContextField(context.field, 'field'),
+        schemaVersion: requireContextField(context.schemaVersion, 'schemaVersion'),
+    };
+    if (context.provider !== undefined) {
+        normalized.provider = requireContextField(context.provider, 'provider');
+    }
+    if (context.extra !== undefined) {
+        normalized.extra = {};
+        for (const [key, value] of Object.entries(context.extra).sort(([left], [right]) => left.localeCompare(right))) {
+            normalized.extra[requireContextField(key, 'extra key')] = requireContextField(value, `extra.${key}`);
+        }
+    }
+    return normalized;
+}
+function requireContextField(value, name) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`SecretCell context ${name} is required`);
+    }
+    return value;
+}
+function canonicalJson(value) {
+    return JSON.stringify(sortJson(value));
+}
+function sortJson(value) {
+    if (Array.isArray(value)) {
+        return value.map(sortJson);
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, entryValue]) => entryValue !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entryValue]) => [key, sortJson(entryValue)]));
+    }
+    return value;
+}
+function toArrayBuffer(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function encodeBase64Url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+function decodeBase64Url(value) {
+    return new Uint8Array(Buffer.from(value, 'base64url'));
+}
+//# sourceMappingURL=SecretCellVault.js.map