@vorionsys/platform-core 0.1.0

package/dist/common/crypto.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Cryptographic utilities for Vorion
+ *
+ * Provides Ed25519 signing for proof records and other cryptographic operations.
+ *
+ * @packageDocumentation
+ */
+import { webcrypto } from 'node:crypto';
+type CryptoKey = webcrypto.CryptoKey;
+/**
+ * Key pair for Ed25519 signing
+ */
+export interface KeyPair {
+    publicKey: CryptoKey;
+    privateKey: CryptoKey;
+}
+/**
+ * Exported key pair (for storage)
+ */
+export interface ExportedKeyPair {
+    publicKey: string;
+    privateKey: string;
+}
+/**
+ * Signature result
+ */
+export interface SignatureResult {
+    signature: string;
+    publicKey: string;
+    algorithm: 'Ed25519' | 'ECDSA-P256';
+    signedAt: string;
+}
+/**
+ * Verification result
+ */
+export interface VerifyResult {
+    valid: boolean;
+    verifiedAt: string;
+    error?: string;
+}
+/**
+ * Generate a new Ed25519 key pair
+ */
+export declare function generateKeyPair(): Promise<KeyPair>;
+/**
+ * Export a key pair to base64 strings
+ */
+export declare function exportKeyPair(keyPair: KeyPair): Promise<ExportedKeyPair>;
+/**
+ * Import a key pair from base64 strings
+ */
+export declare function importKeyPair(exported: ExportedKeyPair): Promise<KeyPair>;
+/**
+ * Get or create the signing key pair
+ */
+export declare function getSigningKeyPair(): Promise<KeyPair>;
+/**
+ * Sign data with Ed25519/ECDSA
+ */
+export declare function sign(data: string): Promise<SignatureResult>;
+/**
+ * Verify a signature
+ */
+export declare function verify(data: string, signature: string, publicKey: string): Promise<VerifyResult>;
+/**
+ * Calculate SHA-256 hash
+ */
+export declare function sha256(data: string): Promise<string>;
+export {};
+//# sourceMappingURL=crypto.d.ts.map

package/dist/common/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/common/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,KAAK,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;AAIrC;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,SAAS,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,YAAY,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CA4BxD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAQ9E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CA2C/E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CA0B1D;AAED;;GAEG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA+BjE;AAED;;GAEG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC,CAsDvB;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK1D"}

package/dist/common/crypto.js

@@ -0,0 +1,201 @@
+/**
+ * Cryptographic utilities for Vorion
+ *
+ * Provides Ed25519 signing for proof records and other cryptographic operations.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from './logger.js';
+import { allowEphemeralKey } from './security-mode.js';
+const logger = createLogger({ component: 'crypto' });
+// Cached key pair for signing
+let cachedKeyPair = null;
+/**
+ * Generate a new Ed25519 key pair
+ */
+export async function generateKeyPair() {
+    try {
+        const keyPair = await crypto.subtle.generateKey({
+            name: 'Ed25519',
+        }, true, // extractable
+        ['sign', 'verify']);
+        logger.info('Generated new Ed25519 key pair');
+        return keyPair;
+    }
+    catch (error) {
+        // Ed25519 might not be supported in all environments
+        // Fall back to ECDSA with P-256
+        logger.warn('Ed25519 not supported, falling back to ECDSA P-256');
+        const keyPair = await crypto.subtle.generateKey({
+            name: 'ECDSA',
+            namedCurve: 'P-256',
+        }, true, ['sign', 'verify']);
+        return keyPair;
+    }
+}
+/**
+ * Export a key pair to base64 strings
+ */
+export async function exportKeyPair(keyPair) {
+    const publicKeyBuffer = await crypto.subtle.exportKey('spki', keyPair.publicKey);
+    const privateKeyBuffer = await crypto.subtle.exportKey('pkcs8', keyPair.privateKey);
+    return {
+        publicKey: bufferToBase64(publicKeyBuffer),
+        privateKey: bufferToBase64(privateKeyBuffer),
+    };
+}
+/**
+ * Import a key pair from base64 strings
+ */
+export async function importKeyPair(exported) {
+    const publicKeyBuffer = base64ToBuffer(exported.publicKey);
+    const privateKeyBuffer = base64ToBuffer(exported.privateKey);
+    // Try Ed25519 first, fall back to ECDSA
+    try {
+        const publicKey = await crypto.subtle.importKey('spki', publicKeyBuffer, { name: 'Ed25519' }, true, ['verify']);
+        const privateKey = await crypto.subtle.importKey('pkcs8', privateKeyBuffer, { name: 'Ed25519' }, true, ['sign']);
+        return { publicKey, privateKey };
+    }
+    catch {
+        // Fall back to ECDSA
+        const publicKey = await crypto.subtle.importKey('spki', publicKeyBuffer, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['verify']);
+        const privateKey = await crypto.subtle.importKey('pkcs8', privateKeyBuffer, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign']);
+        return { publicKey, privateKey };
+    }
+}
+/**
+ * Get or create the signing key pair
+ */
+export async function getSigningKeyPair() {
+    if (cachedKeyPair) {
+        return cachedKeyPair;
+    }
+    // Check for environment variable with exported key
+    const exportedKey = process.env['VORION_SIGNING_KEY'];
+    if (exportedKey) {
+        try {
+            const parsed = JSON.parse(exportedKey);
+            cachedKeyPair = await importKeyPair(parsed);
+            logger.info('Loaded signing key from environment');
+            return cachedKeyPair;
+        }
+        catch (error) {
+            logger.error({ error }, 'Failed to load signing key from environment');
+        }
+    }
+    // Generate new key pair
+    cachedKeyPair = await generateKeyPair();
+    // SE-C2: Use security mode to guard ephemeral keys
+    // allowEphemeralKey throws in production/staging, warns in development
+    allowEphemeralKey('signing');
+    return cachedKeyPair;
+}
+/**
+ * Sign data with Ed25519/ECDSA
+ */
+export async function sign(data) {
+    const keyPair = await getSigningKeyPair();
+    const encoder = new TextEncoder();
+    const dataBuffer = encoder.encode(data);
+    // Determine algorithm from key
+    const algorithm = keyPair.privateKey.algorithm.name;
+    let signature;
+    if (algorithm === 'Ed25519') {
+        signature = await crypto.subtle.sign('Ed25519', keyPair.privateKey, dataBuffer);
+    }
+    else {
+        signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, keyPair.privateKey, dataBuffer);
+    }
+    const publicKeyBuffer = await crypto.subtle.exportKey('spki', keyPair.publicKey);
+    // CR-H1: Return correct algorithm based on actual key type
+    // Previously always returned 'Ed25519' even when using ECDSA fallback
+    const actualAlgorithm = algorithm === 'Ed25519' ? 'Ed25519' : 'ECDSA-P256';
+    return {
+        signature: bufferToBase64(signature),
+        publicKey: bufferToBase64(publicKeyBuffer),
+        algorithm: actualAlgorithm, // Type assertion for backward compatibility
+        signedAt: new Date().toISOString(),
+    };
+}
+/**
+ * Verify a signature
+ */
+export async function verify(data, signature, publicKey) {
+    try {
+        const encoder = new TextEncoder();
+        const dataBuffer = encoder.encode(data);
+        const signatureBuffer = base64ToBuffer(signature);
+        const publicKeyBuffer = base64ToBuffer(publicKey);
+        // Try Ed25519 first
+        let cryptoKey;
+        let algorithm;
+        try {
+            cryptoKey = await crypto.subtle.importKey('spki', publicKeyBuffer, { name: 'Ed25519' }, false, ['verify']);
+            algorithm = 'Ed25519';
+        }
+        catch {
+            // Fall back to ECDSA
+            cryptoKey = await crypto.subtle.importKey('spki', publicKeyBuffer, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+            algorithm = 'ECDSA';
+        }
+        let valid;
+        if (algorithm === 'Ed25519') {
+            valid = await crypto.subtle.verify('Ed25519', cryptoKey, signatureBuffer, dataBuffer);
+        }
+        else {
+            valid = await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, cryptoKey, signatureBuffer, dataBuffer);
+        }
+        return {
+            valid,
+            verifiedAt: new Date().toISOString(),
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            verifiedAt: new Date().toISOString(),
+            error: error.message,
+        };
+    }
+}
+/**
+ * Calculate SHA-256 hash
+ */
+export async function sha256(data) {
+    const encoder = new TextEncoder();
+    const dataBuffer = encoder.encode(data);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
+    return bufferToHex(hashBuffer);
+}
+/**
+ * Convert ArrayBuffer to base64 string
+ */
+function bufferToBase64(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+/**
+ * Convert base64 string to ArrayBuffer
+ */
+function base64ToBuffer(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+/**
+ * Convert ArrayBuffer to hex string
+ */
+function bufferToHex(buffer) {
+    const bytes = new Uint8Array(buffer);
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/common/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/common/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAqB,MAAM,oBAAoB,CAAC;AAK1E,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAqCrD,8BAA8B;AAC9B,IAAI,aAAa,GAAmB,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C;YACE,IAAI,EAAE,SAAS;SAChB,EACD,IAAI,EAAE,cAAc;QACpB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,OAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qDAAqD;QACrD,gCAAgC;QAChC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C;YACE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,OAAO;SACpB,EACD,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;QAEF,OAAO,OAAkB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjF,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpF,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,eAAe,CAAC;QAC1C,UAAU,EAAE,cAAc,CAAC,gBAAgB,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAyB;IAC3D,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE7D,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,MAAM,EACN,eAAe,EACf,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC9C,OAAO,EACP,gBAAgB,EAChB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,IAAI,EACJ,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,MAAM,EACN,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC9C,OAAO,EACP,gBAAgB,EAChB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAoB,CAAC;YAC1D,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,aAAa,GAAG,MAAM,eAAe,EAAE,CAAC;IAExC,mDAAmD;IACnD,uEAAuE;IACvE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAExC,+BAA+B;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;IAEpD,IAAI,SAAsB,CAAC;IAC3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,OAAO,CAAC,UAAU,EAClB,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEjF,2DAA2D;IAC3D,sEAAsE;IACtE,MAAM,eAAe,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAE3E,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,cAAc,CAAC,eAAe,CAAC;QAC1C,SAAS,EAAE,eAA4B,EAAE,4CAA4C;QACrF,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAY,EACZ,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAElD,oBAAoB;QACpB,IAAI,SAAoB,CAAC;QACzB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,MAAM,EACN,eAAe,EACf,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;YACrB,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,MAAM,EACN,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,SAAS,GAAG,OAAO,CAAC;QACtB,CAAC;QAED,IAAI,KAAc,CAAC;QACnB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,SAAS,EACT,eAAe,EACf,UAAU,CACX,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK;YACL,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAG,KAAe,CAAC,OAAO;SAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAmB;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/common/database-resilience.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Database Circuit Breaker and Resilience
+ *
+ * Provides circuit breaker protection for database operations to prevent
+ * cascading failures when the database is unavailable or degraded.
+ *
+ * Features:
+ * - Circuit breaker with CLOSED -> OPEN -> HALF_OPEN states
+ * - Configurable failure threshold and reset timeout
+ * - Statement timeout enforcement via PostgreSQL
+ * - Metrics export for monitoring
+ * - Graceful degradation support
+ *
+ * @packageDocumentation
+ */
+import { CircuitState, CircuitBreakerOpenError } from './circuit-breaker.js';
+import type { CircuitBreaker } from './circuit-breaker.js';
+export { CircuitState, CircuitBreakerOpenError };
+/**
+ * Database operation timeout in milliseconds
+ * Default: 30 seconds (configurable via config)
+ */
+export declare const DB_OPERATION_TIMEOUT_MS = 30000;
+/**
+ * Database circuit breaker service name
+ */
+export declare const DATABASE_SERVICE_NAME = "database";
+/**
+ * Get the database circuit breaker instance
+ */
+export declare function getDatabaseCircuitBreaker(): CircuitBreaker;
+/**
+ * Check if the database circuit is currently open
+ */
+export declare function isDatabaseCircuitOpen(): Promise<boolean>;
+/**
+ * Get database circuit breaker status for monitoring
+ */
+export declare function getDatabaseCircuitStatus(): Promise<{
+    name: string;
+    state: CircuitState;
+    failureCount: number;
+    failureThreshold: number;
+    resetTimeoutMs: number;
+    timeUntilReset: number | null;
+}>;
+/**
+ * Execute a database query with circuit breaker protection and timeout.
+ *
+ * This wrapper provides:
+ * 1. Circuit breaker protection - fast fail when DB is unhealthy
+ * 2. Statement timeout - prevents long-running queries
+ * 3. Metrics recording - tracks success/failure rates
+ *
+ * @param fn - The database operation to execute
+ * @param options - Optional configuration
+ * @returns The result of the database operation
+ * @throws CircuitBreakerOpenError when circuit is open
+ * @throws StatementTimeoutError when query exceeds timeout
+ *
+ * @example
+ * ```typescript
+ * const users = await withDatabaseCircuitBreaker(
+ *   async () => db.select().from(users).limit(100),
+ *   { operationName: 'listUsers' }
+ * );
+ * ```
+ */
+export declare function withDatabaseCircuitBreaker<T>(fn: () => Promise<T>, options?: {
+    operationName?: string;
+    timeoutMs?: number;
+}): Promise<T>;
+/**
+ * Execute a database operation with circuit breaker protection,
+ * returning a result object instead of throwing on circuit open.
+ *
+ * This variant is useful when you want to handle circuit open gracefully
+ * without try/catch, or when you want to use a fallback value.
+ *
+ * @param fn - The database operation to execute
+ * @param options - Optional configuration
+ * @returns Result object with success flag and result/error
+ *
+ * @example
+ * ```typescript
+ * const result = await withDatabaseCircuitBreakerResult(
+ *   async () => db.select().from(cache).where(eq(cache.key, key)),
+ *   { operationName: 'getCacheEntry' }
+ * );
+ *
+ * if (result.circuitOpen) {
+ *   // Use fallback - maybe return cached data or default
+ *   return getFromLocalCache(key) ?? defaultValue;
+ * }
+ *
+ * return result.success ? result.result : defaultValue;
+ * ```
+ */
+export declare function withDatabaseCircuitBreakerResult<T>(fn: () => Promise<T>, options?: {
+    operationName?: string;
+    timeoutMs?: number;
+}): Promise<{
+    success: boolean;
+    result?: T;
+    error?: Error;
+    circuitOpen: boolean;
+}>;
+/**
+ * Execute a raw SQL query with circuit breaker protection.
+ *
+ * For cases where you need to execute raw SQL without Drizzle ORM.
+ *
+ * @param sql - SQL query string
+ * @param params - Query parameters
+ * @param options - Optional configuration
+ * @returns Query result
+ */
+export declare function executeWithCircuitBreaker<T = unknown>(sql: string, params?: unknown[], options?: {
+    operationName?: string;
+    timeoutMs?: number;
+}): Promise<T[]>;
+/**
+ * Force the database circuit breaker to open state.
+ * Useful for manual intervention during maintenance or incidents.
+ */
+export declare function forceDatabaseCircuitOpen(): Promise<void>;
+/**
+ * Force the database circuit breaker to closed state.
+ * Useful for manual recovery after maintenance.
+ */
+export declare function forceDatabaseCircuitClose(): Promise<void>;
+/**
+ * Reset the database circuit breaker.
+ * Clears all state and returns to CLOSED state.
+ */
+export declare function resetDatabaseCircuit(): Promise<void>;
+/**
+ * Database health check with circuit breaker status.
+ *
+ * Returns comprehensive health information including:
+ * - Database connectivity status
+ * - Circuit breaker state
+ * - Latency metrics
+ */
+export declare function checkDatabaseHealthWithCircuit(): Promise<{
+    healthy: boolean;
+    latencyMs?: number;
+    error?: string;
+    circuit: {
+        state: CircuitState;
+        failureCount: number;
+        failureThreshold: number;
+        timeUntilReset: number | null;
+    };
+}>;
+//# sourceMappingURL=database-resilience.d.ts.map

package/dist/common/database-resilience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-resilience.d.ts","sourceRoot":"","sources":["../../src/common/database-resilience.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,YAAY,EAEZ,uBAAuB,EAGxB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,cAAc,CAO1D;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG9D;AAED;;GAEG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC,CAGD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAChD,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACf,GACL,OAAO,CAAC,CAAC,CAAC,CASZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,gCAAgC,CAAC,CAAC,EACtD,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACf,GACL,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC,CAQD;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,GAAG,OAAO,EACzD,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAAO,EAAO,EACtB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACf,GACL,OAAO,CAAC,CAAC,EAAE,CAAC,CAoBd;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAI9D;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAI/D;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1D;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP,KAAK,EAAE,YAAY,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;CACH,CAAC,CA4FD"}