@wopr-network/platform-core 0.1.0

package/dist/security/credential-vault/audit-repository.d.ts

@@ -0,0 +1,27 @@
+import type { PlatformDb } from "../../db/index.js";
+export interface SecretAuditEvent {
+    id: string;
+    credentialId: string;
+    accessedAt: number;
+    accessedBy: string;
+    action: "read" | "write" | "delete";
+    ip: string | null;
+}
+export interface ISecretAuditRepository {
+    insert(event: SecretAuditEvent): Promise<void>;
+    listByCredentialId(credentialId: string, opts: {
+        limit: number;
+        offset: number;
+    }): Promise<SecretAuditEvent[]>;
+    countByCredentialId(credentialId: string): Promise<number>;
+}
+export declare class DrizzleSecretAuditRepository implements ISecretAuditRepository {
+    private readonly db;
+    constructor(db: PlatformDb);
+    insert(event: SecretAuditEvent): Promise<void>;
+    listByCredentialId(credentialId: string, opts: {
+        limit: number;
+        offset: number;
+    }): Promise<SecretAuditEvent[]>;
+    countByCredentialId(credentialId: string): Promise<number>;
+}

package/dist/security/credential-vault/audit-repository.js

@@ -0,0 +1,42 @@
+import { count, desc, eq } from "drizzle-orm";
+import { secretAuditLog } from "../../db/schema/index.js";
+const MAX_LIMIT = 250;
+export class DrizzleSecretAuditRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async insert(event) {
+        await this.db.insert(secretAuditLog).values({
+            id: event.id,
+            credentialId: event.credentialId,
+            accessedAt: event.accessedAt,
+            accessedBy: event.accessedBy,
+            action: event.action,
+            ip: event.ip,
+        });
+    }
+    async listByCredentialId(credentialId, opts) {
+        const limit = Math.min(Math.max(1, opts.limit), MAX_LIMIT);
+        const offset = Math.max(0, opts.offset);
+        const rows = await this.db
+            .select()
+            .from(secretAuditLog)
+            .where(eq(secretAuditLog.credentialId, credentialId))
+            .orderBy(desc(secretAuditLog.accessedAt))
+            .limit(limit)
+            .offset(offset);
+        return rows.map((r) => ({
+            id: r.id,
+            credentialId: r.credentialId,
+            accessedAt: r.accessedAt,
+            accessedBy: r.accessedBy,
+            action: r.action,
+            ip: r.ip,
+        }));
+    }
+    async countByCredentialId(credentialId) {
+        const result = (await this.db.select({ count: count() }).from(secretAuditLog).where(eq(secretAuditLog.credentialId, credentialId)))[0];
+        return result?.count ?? 0;
+    }
+}

package/dist/security/credential-vault/audit-repository.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/credential-vault/audit-repository.test.js

@@ -0,0 +1,78 @@
+import { randomUUID } from "node:crypto";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { createTestDb, truncateAllTables } from "../../test/db.js";
+import { DrizzleSecretAuditRepository } from "./audit-repository.js";
+let db;
+let pool;
+let repo;
+beforeAll(async () => {
+    ({ db, pool } = await createTestDb());
+});
+afterAll(async () => {
+    await pool.close();
+});
+beforeEach(async () => {
+    await truncateAllTables(pool);
+    repo = new DrizzleSecretAuditRepository(db);
+});
+describe("DrizzleSecretAuditRepository", () => {
+    const credentialId = "cred-1";
+    it("inserts and retrieves audit events", async () => {
+        const event = {
+            id: randomUUID(),
+            credentialId,
+            accessedAt: Date.now(),
+            accessedBy: "user-1",
+            action: "read",
+            ip: "127.0.0.1",
+        };
+        await repo.insert(event);
+        const events = await repo.listByCredentialId(credentialId, { limit: 50, offset: 0 });
+        expect(events).toHaveLength(1);
+        expect(events[0]).toMatchObject({
+            id: event.id,
+            credentialId,
+            accessedBy: "user-1",
+            action: "read",
+            ip: "127.0.0.1",
+        });
+    });
+    it("counts events by credential ID", async () => {
+        for (let i = 0; i < 3; i++) {
+            await repo.insert({
+                id: randomUUID(),
+                credentialId,
+                accessedAt: Date.now() + i,
+                accessedBy: "user-1",
+                action: "read",
+                ip: null,
+            });
+        }
+        const count = await repo.countByCredentialId(credentialId);
+        expect(count).toBe(3);
+    });
+    it("paginates results ordered by accessedAt desc", async () => {
+        for (let i = 0; i < 5; i++) {
+            await repo.insert({
+                id: randomUUID(),
+                credentialId,
+                accessedAt: 1000 + i,
+                accessedBy: "user-1",
+                action: "read",
+                ip: null,
+            });
+        }
+        const page1 = await repo.listByCredentialId(credentialId, { limit: 2, offset: 0 });
+        expect(page1).toHaveLength(2);
+        expect(page1[0]?.accessedAt).toBe(1004); // newest first
+        const page2 = await repo.listByCredentialId(credentialId, { limit: 2, offset: 2 });
+        expect(page2).toHaveLength(2);
+        expect(page2[0]?.accessedAt).toBe(1002);
+    });
+    it("returns empty for unknown credential", async () => {
+        const events = await repo.listByCredentialId("nonexistent", { limit: 50, offset: 0 });
+        expect(events).toHaveLength(0);
+        const count = await repo.countByCredentialId("nonexistent");
+        expect(count).toBe(0);
+    });
+});

package/dist/security/credential-vault/credential-repository.d.ts

@@ -0,0 +1,94 @@
+import type { PlatformDb } from "../../db/index.js";
+/** A full credential row from the database — includes encrypted value. */
+export interface CredentialRow {
+    id: string;
+    provider: string;
+    keyName: string;
+    encryptedValue: string;
+    authType: string;
+    authHeader: string | null;
+    isActive: boolean;
+    lastValidated: string | null;
+    createdAt: string;
+    rotatedAt: string | null;
+    createdBy: string;
+}
+/** A credential row without the encrypted value — for listing. */
+export interface CredentialSummaryRow {
+    id: string;
+    provider: string;
+    keyName: string;
+    authType: string;
+    authHeader: string | null;
+    isActive: boolean;
+    lastValidated: string | null;
+    createdAt: string;
+    rotatedAt: string | null;
+    createdBy: string;
+}
+export interface InsertCredentialRow {
+    id: string;
+    provider: string;
+    keyName: string;
+    encryptedValue: string;
+    authType: string;
+    authHeader: string | null;
+    createdBy: string;
+}
+/** Pure storage repository for provider credentials. No encryption logic. */
+export interface ICredentialRepository {
+    insert(data: InsertCredentialRow): Promise<void>;
+    getFullById(id: string): Promise<CredentialRow | null>;
+    getSummaryById(id: string): Promise<CredentialSummaryRow | null>;
+    list(provider?: string): Promise<CredentialSummaryRow[]>;
+    listActiveForProvider(provider: string): Promise<CredentialRow[]>;
+    updateEncryptedValue(id: string, encryptedValue: string): Promise<boolean>;
+    setActive(id: string, isActive: boolean): Promise<boolean>;
+    markValidated(id: string): Promise<boolean>;
+    deleteById(id: string): Promise<boolean>;
+}
+/** Narrow interface for migration-only access to provider_credentials encrypted values. */
+export interface ICredentialMigrationAccess {
+    listAllWithEncryptedValue(): Promise<Array<{
+        id: string;
+        encryptedValue: string;
+    }>>;
+    updateEncryptedValueOnly(id: string, encryptedValue: string): Promise<void>;
+}
+/** Narrow interface for tenant_api_keys migration access. */
+export interface IMigrationTenantKeyAccess {
+    listAll(): Promise<Array<{
+        id: string;
+        tenantId: string;
+        encryptedKey: string;
+    }>>;
+    updateEncryptedKey(id: string, encryptedKey: string): Promise<void>;
+}
+export declare class DrizzleCredentialRepository implements ICredentialRepository, ICredentialMigrationAccess {
+    private readonly db;
+    constructor(db: PlatformDb);
+    insert(data: InsertCredentialRow): Promise<void>;
+    getFullById(id: string): Promise<CredentialRow | null>;
+    getSummaryById(id: string): Promise<CredentialSummaryRow | null>;
+    list(provider?: string): Promise<CredentialSummaryRow[]>;
+    listActiveForProvider(provider: string): Promise<CredentialRow[]>;
+    updateEncryptedValue(id: string, encryptedValue: string): Promise<boolean>;
+    setActive(id: string, isActive: boolean): Promise<boolean>;
+    markValidated(id: string): Promise<boolean>;
+    deleteById(id: string): Promise<boolean>;
+    listAllWithEncryptedValue(): Promise<Array<{
+        id: string;
+        encryptedValue: string;
+    }>>;
+    updateEncryptedValueOnly(id: string, encryptedValue: string): Promise<void>;
+}
+export declare class DrizzleMigrationTenantKeyAccess implements IMigrationTenantKeyAccess {
+    private readonly db;
+    constructor(db: PlatformDb);
+    listAll(): Promise<Array<{
+        id: string;
+        tenantId: string;
+        encryptedKey: string;
+    }>>;
+    updateEncryptedKey(id: string, encryptedKey: string): Promise<void>;
+}

package/dist/security/credential-vault/credential-repository.js

@@ -0,0 +1,145 @@
+import { and, desc, eq } from "drizzle-orm";
+import { providerCredentials, tenantApiKeys } from "../../db/schema/index.js";
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+export class DrizzleCredentialRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async insert(data) {
+        await this.db.insert(providerCredentials).values({
+            id: data.id,
+            provider: data.provider,
+            keyName: data.keyName,
+            encryptedValue: data.encryptedValue,
+            authType: data.authType,
+            authHeader: data.authHeader,
+            isActive: true,
+            createdBy: data.createdBy,
+        });
+    }
+    async getFullById(id) {
+        const row = (await this.db.select().from(providerCredentials).where(eq(providerCredentials.id, id)))[0];
+        return row ? toFullRow(row) : null;
+    }
+    async getSummaryById(id) {
+        const row = (await this.db
+            .select({
+            id: providerCredentials.id,
+            provider: providerCredentials.provider,
+            keyName: providerCredentials.keyName,
+            authType: providerCredentials.authType,
+            authHeader: providerCredentials.authHeader,
+            isActive: providerCredentials.isActive,
+            lastValidated: providerCredentials.lastValidated,
+            createdAt: providerCredentials.createdAt,
+            rotatedAt: providerCredentials.rotatedAt,
+            createdBy: providerCredentials.createdBy,
+        })
+            .from(providerCredentials)
+            .where(eq(providerCredentials.id, id)))[0];
+        return row ?? null;
+    }
+    async list(provider) {
+        const where = provider ? eq(providerCredentials.provider, provider) : undefined;
+        return this.db
+            .select({
+            id: providerCredentials.id,
+            provider: providerCredentials.provider,
+            keyName: providerCredentials.keyName,
+            authType: providerCredentials.authType,
+            authHeader: providerCredentials.authHeader,
+            isActive: providerCredentials.isActive,
+            lastValidated: providerCredentials.lastValidated,
+            createdAt: providerCredentials.createdAt,
+            rotatedAt: providerCredentials.rotatedAt,
+            createdBy: providerCredentials.createdBy,
+        })
+            .from(providerCredentials)
+            .where(where)
+            .orderBy(desc(providerCredentials.createdAt));
+    }
+    async listActiveForProvider(provider) {
+        const rows = await this.db
+            .select()
+            .from(providerCredentials)
+            .where(and(eq(providerCredentials.provider, provider), eq(providerCredentials.isActive, true)));
+        return rows.map(toFullRow);
+    }
+    async updateEncryptedValue(id, encryptedValue) {
+        const result = await this.db
+            .update(providerCredentials)
+            .set({ encryptedValue, rotatedAt: new Date().toISOString() })
+            .where(eq(providerCredentials.id, id))
+            .returning({ id: providerCredentials.id });
+        return result.length > 0;
+    }
+    async setActive(id, isActive) {
+        const result = await this.db
+            .update(providerCredentials)
+            .set({ isActive })
+            .where(eq(providerCredentials.id, id))
+            .returning({ id: providerCredentials.id });
+        return result.length > 0;
+    }
+    async markValidated(id) {
+        const result = await this.db
+            .update(providerCredentials)
+            .set({ lastValidated: new Date().toISOString() })
+            .where(eq(providerCredentials.id, id))
+            .returning({ id: providerCredentials.id });
+        return result.length > 0;
+    }
+    async deleteById(id) {
+        const result = await this.db
+            .delete(providerCredentials)
+            .where(eq(providerCredentials.id, id))
+            .returning({ id: providerCredentials.id });
+        return result.length > 0;
+    }
+    async listAllWithEncryptedValue() {
+        return this.db
+            .select({ id: providerCredentials.id, encryptedValue: providerCredentials.encryptedValue })
+            .from(providerCredentials);
+    }
+    async updateEncryptedValueOnly(id, encryptedValue) {
+        await this.db.update(providerCredentials).set({ encryptedValue }).where(eq(providerCredentials.id, id));
+    }
+}
+// ---------------------------------------------------------------------------
+// Tenant key migration access (for migrate-plaintext.ts)
+// ---------------------------------------------------------------------------
+export class DrizzleMigrationTenantKeyAccess {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async listAll() {
+        return this.db
+            .select({ id: tenantApiKeys.id, tenantId: tenantApiKeys.tenantId, encryptedKey: tenantApiKeys.encryptedKey })
+            .from(tenantApiKeys);
+    }
+    async updateEncryptedKey(id, encryptedKey) {
+        await this.db.update(tenantApiKeys).set({ encryptedKey }).where(eq(tenantApiKeys.id, id));
+    }
+}
+// ---------------------------------------------------------------------------
+// Row -> Domain mapper
+// ---------------------------------------------------------------------------
+function toFullRow(row) {
+    return {
+        id: row.id,
+        provider: row.provider,
+        keyName: row.keyName,
+        encryptedValue: row.encryptedValue,
+        authType: row.authType,
+        authHeader: row.authHeader,
+        isActive: row.isActive,
+        lastValidated: row.lastValidated,
+        createdAt: row.createdAt,
+        rotatedAt: row.rotatedAt,
+        createdBy: row.createdBy,
+    };
+}

package/dist/security/credential-vault/credential-repository.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/credential-vault/credential-repository.test.js

@@ -0,0 +1,206 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { createTestDb, truncateAllTables } from "../../test/db.js";
+import { DrizzleCredentialRepository } from "./credential-repository.js";
+function makeRow(overrides = {}) {
+    return {
+        id: overrides.id ?? "cred-001",
+        provider: overrides.provider ?? "anthropic",
+        keyName: overrides.keyName ?? "Production Key",
+        encryptedValue: overrides.encryptedValue ?? "enc::cipher::abc123",
+        authType: overrides.authType ?? "header",
+        authHeader: overrides.authHeader ?? "x-api-key",
+        createdBy: overrides.createdBy ?? "admin-1",
+        ...overrides,
+    };
+}
+describe("DrizzleCredentialRepository", () => {
+    let pool;
+    let db;
+    let repo;
+    beforeAll(async () => {
+        ({ db, pool } = await createTestDb());
+    });
+    afterAll(async () => {
+        await pool.close();
+    });
+    beforeEach(async () => {
+        await truncateAllTables(pool);
+        repo = new DrizzleCredentialRepository(db);
+    });
+    // --- CRUD: insert + getFullById ---
+    describe("insert + getFullById", () => {
+        it("inserts a credential and reads it back", async () => {
+            const row = makeRow();
+            await repo.insert(row);
+            const result = await repo.getFullById("cred-001");
+            expect(result).not.toBeNull();
+            expect(result?.id).toBe("cred-001");
+            expect(result?.provider).toBe("anthropic");
+            expect(result?.keyName).toBe("Production Key");
+            expect(result?.encryptedValue).toBe("enc::cipher::abc123");
+            expect(result?.authType).toBe("header");
+            expect(result?.authHeader).toBe("x-api-key");
+            expect(result?.isActive).toBe(true);
+            expect(result?.createdBy).toBe("admin-1");
+            expect(result?.createdAt).toMatch(/^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}/);
+        });
+        it("returns null for non-existent ID", async () => {
+            const result = await repo.getFullById("no-such-id");
+            expect(result).toBeNull();
+        });
+    });
+    // --- getSummaryById ---
+    describe("getSummaryById", () => {
+        it("returns summary without encryptedValue", async () => {
+            await repo.insert(makeRow());
+            const summary = await repo.getSummaryById("cred-001");
+            expect(summary).not.toBeNull();
+            expect(summary?.id).toBe("cred-001");
+            expect(summary?.provider).toBe("anthropic");
+            expect(summary !== null && "encryptedValue" in summary).toBe(false);
+        });
+        it("returns null for non-existent ID", async () => {
+            expect(await repo.getSummaryById("missing")).toBeNull();
+        });
+    });
+    // --- list ---
+    describe("list", () => {
+        it("lists all credentials as summaries", async () => {
+            await repo.insert(makeRow({ id: "c1", provider: "anthropic" }));
+            await repo.insert(makeRow({ id: "c2", provider: "openai" }));
+            const all = await repo.list();
+            expect(all).toHaveLength(2);
+            for (const s of all) {
+                expect("encryptedValue" in s).toBe(false);
+            }
+        });
+        it("filters by provider", async () => {
+            await repo.insert(makeRow({ id: "c1", provider: "anthropic" }));
+            await repo.insert(makeRow({ id: "c2", provider: "openai" }));
+            const filtered = await repo.list("openai");
+            expect(filtered).toHaveLength(1);
+            expect(filtered[0].provider).toBe("openai");
+        });
+        it("returns empty array when no credentials exist", async () => {
+            expect(await repo.list()).toEqual([]);
+        });
+    });
+    // --- listActiveForProvider ---
+    describe("listActiveForProvider", () => {
+        it("returns only active credentials for a provider", async () => {
+            await repo.insert(makeRow({ id: "c1", provider: "anthropic" }));
+            await repo.insert(makeRow({ id: "c2", provider: "anthropic" }));
+            await repo.setActive("c2", false);
+            const active = await repo.listActiveForProvider("anthropic");
+            expect(active).toHaveLength(1);
+            expect(active[0].id).toBe("c1");
+            expect(active[0].encryptedValue).toBe("enc::cipher::abc123");
+        });
+        it("does not return credentials from other providers", async () => {
+            await repo.insert(makeRow({ id: "c1", provider: "anthropic" }));
+            await repo.insert(makeRow({ id: "c2", provider: "openai" }));
+            const active = await repo.listActiveForProvider("anthropic");
+            expect(active).toHaveLength(1);
+            expect(active[0].id).toBe("c1");
+        });
+    });
+    // --- Encryption-at-rest verification ---
+    describe("encryption-at-rest", () => {
+        it("stores encryptedValue verbatim (round-trip fidelity)", async () => {
+            const encryptedValue = "ENCRYPTED::v1::abc123xyz";
+            await repo.insert(makeRow({ id: "enc-test", encryptedValue }));
+            const result = await repo.getFullById("enc-test");
+            expect(result?.encryptedValue).toBe(encryptedValue);
+        });
+        it("updateEncryptedValue changes the stored ciphertext", async () => {
+            await repo.insert(makeRow({ id: "rot-test", encryptedValue: "cipher-v1" }));
+            const updated = await repo.updateEncryptedValue("rot-test", "cipher-v2");
+            expect(updated).toBe(true);
+            const row = await repo.getFullById("rot-test");
+            expect(row?.encryptedValue).toBe("cipher-v2");
+            expect(row?.rotatedAt).toMatch(/^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}/);
+        });
+    });
+    // --- Provider isolation (closest analog to tenant isolation) ---
+    describe("provider/creator isolation", () => {
+        it("list() with provider filter isolates results", async () => {
+            await repo.insert(makeRow({ id: "a1", provider: "anthropic", createdBy: "admin-A" }));
+            await repo.insert(makeRow({ id: "o1", provider: "openai", createdBy: "admin-B" }));
+            const anthropicCreds = await repo.list("anthropic");
+            expect(anthropicCreds).toHaveLength(1);
+            expect(anthropicCreds[0].id).toBe("a1");
+            const openaiCreds = await repo.list("openai");
+            expect(openaiCreds).toHaveLength(1);
+            expect(openaiCreds[0].id).toBe("o1");
+        });
+        it("getFullById only returns exact ID match", async () => {
+            await repo.insert(makeRow({ id: "a1", provider: "anthropic" }));
+            await repo.insert(makeRow({ id: "o1", provider: "openai" }));
+            expect(await repo.getFullById("a1")).not.toBeNull();
+            expect(await repo.getFullById("o1")).not.toBeNull();
+            expect(await repo.getFullById("a2")).toBeNull();
+        });
+    });
+    // --- deleteById ---
+    describe("deleteById", () => {
+        it("deletes an existing credential and returns true", async () => {
+            await repo.insert(makeRow({ id: "del-1" }));
+            expect(await repo.deleteById("del-1")).toBe(true);
+            expect(await repo.getFullById("del-1")).toBeNull();
+        });
+        it("returns false for non-existent ID", async () => {
+            expect(await repo.deleteById("no-such")).toBe(false);
+        });
+    });
+    // --- setActive ---
+    describe("setActive", () => {
+        it("deactivates an active credential", async () => {
+            await repo.insert(makeRow({ id: "sa-1" }));
+            expect(await repo.setActive("sa-1", false)).toBe(true);
+            const row = await repo.getFullById("sa-1");
+            expect(row?.isActive).toBe(false);
+        });
+        it("reactivates a deactivated credential", async () => {
+            await repo.insert(makeRow({ id: "sa-2" }));
+            await repo.setActive("sa-2", false);
+            expect(await repo.setActive("sa-2", true)).toBe(true);
+            const row = await repo.getFullById("sa-2");
+            expect(row?.isActive).toBe(true);
+        });
+        it("returns false for non-existent ID", async () => {
+            expect(await repo.setActive("missing", false)).toBe(false);
+        });
+    });
+    // --- markValidated ---
+    describe("markValidated", () => {
+        it("sets lastValidated timestamp", async () => {
+            await repo.insert(makeRow({ id: "mv-1" }));
+            expect(await repo.markValidated("mv-1")).toBe(true);
+            const row = await repo.getFullById("mv-1");
+            expect(row?.lastValidated).toMatch(/^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}/);
+        });
+        it("returns false for non-existent ID", async () => {
+            expect(await repo.markValidated("missing")).toBe(false);
+        });
+    });
+    // --- Migration access ---
+    describe("listAllWithEncryptedValue", () => {
+        it("returns all IDs and encrypted values", async () => {
+            await repo.insert(makeRow({ id: "m1", encryptedValue: "ev1" }));
+            await repo.insert(makeRow({ id: "m2", encryptedValue: "ev2" }));
+            const rows = await repo.listAllWithEncryptedValue();
+            expect(rows).toHaveLength(2);
+            expect(rows.map((r) => r.id).sort()).toEqual(["m1", "m2"]);
+            expect(rows.find((r) => r.id === "m1")?.encryptedValue).toBe("ev1");
+        });
+    });
+    describe("updateEncryptedValueOnly", () => {
+        it("updates encrypted value without touching rotatedAt", async () => {
+            await repo.insert(makeRow({ id: "uev-1", encryptedValue: "old" }));
+            await repo.updateEncryptedValueOnly("uev-1", "new");
+            const row = await repo.getFullById("uev-1");
+            expect(row?.encryptedValue).toBe("new");
+            expect(row?.rotatedAt).toBeNull();
+        });
+    });
+});

package/dist/security/credential-vault/index.d.ts

@@ -0,0 +1,12 @@
+export type { SecretAuditEvent, ISecretAuditRepository } from "./audit-repository.js";
+export { DrizzleSecretAuditRepository } from "./audit-repository.js";
+export type { CredentialRow, CredentialSummaryRow, InsertCredentialRow, ICredentialMigrationAccess, ICredentialRepository, IMigrationTenantKeyAccess, } from "./credential-repository.js";
+export { DrizzleCredentialRepository, DrizzleMigrationTenantKeyAccess } from "./credential-repository.js";
+export type { RotationResult } from "./key-rotation.js";
+export { reEncryptAllCredentials } from "./key-rotation.js";
+export type { MigrationResult } from "./migrate-plaintext.js";
+export { migratePlaintextCredentials } from "./migrate-plaintext.js";
+export type { PlaintextFinding } from "./migration-check.js";
+export { auditCredentialEncryption } from "./migration-check.js";
+export type { AuthType, CreateCredentialInput, CredentialSummary, DecryptedCredential, ICredentialVaultStore, RotateCredentialInput, } from "./store.js";
+export { CredentialVaultStore, getVaultEncryptionKey } from "./store.js";

package/dist/security/credential-vault/index.js

@@ -0,0 +1,6 @@
+export { DrizzleSecretAuditRepository } from "./audit-repository.js";
+export { DrizzleCredentialRepository, DrizzleMigrationTenantKeyAccess } from "./credential-repository.js";
+export { reEncryptAllCredentials } from "./key-rotation.js";
+export { migratePlaintextCredentials } from "./migrate-plaintext.js";
+export { auditCredentialEncryption } from "./migration-check.js";
+export { CredentialVaultStore, getVaultEncryptionKey } from "./store.js";

package/dist/security/credential-vault/key-rotation.d.ts

@@ -0,0 +1,18 @@
+import type { ICredentialMigrationAccess, IMigrationTenantKeyAccess } from "./credential-repository.js";
+export interface RotationResult {
+    providerCredentials: {
+        migrated: number;
+        errors: string[];
+    };
+    tenantKeys: {
+        migrated: number;
+        errors: string[];
+    };
+}
+/**
+ * Re-encrypt all credentials from oldSecret to newSecret.
+ *
+ * MUST be run inside a transaction by the caller.
+ * Back up the database before running this.
+ */
+export declare function reEncryptAllCredentials(credentialAccess: ICredentialMigrationAccess, tenantKeyAccess: IMigrationTenantKeyAccess, oldSecret: string, newSecret: string): Promise<RotationResult>;