atabey 0.1.1-beta → 0.1.2

package/dist/shared/src/modules/security/secrets.js

@@ -0,0 +1,371 @@
+/**
+ * Secret Management & Leak Guard (Phase 1.5)
+ *
+ * Provides:
+ *   1. Encrypted local secret vault (.atabey/secrets.vault.json) using AES-256-GCM
+ *      with per-secret random salt (HKDF-SHA256) and 96-bit IV.
+ *   2. Subprocess environment scrubber (strips sensitive keys before spawning child processes).
+ *   3. Secret leak scanner (detects API keys, cloud credentials, private keys, and vault values).
+ */
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../storage/storage.js";
+/** Env var names or patterns that must never leak into untrusted subprocesses. */
+const SENSITIVE_ENV_PATTERNS = [
+    /_KEY$/i,
+    /_KEYS$/i,
+    /_SECRET/i,
+    /_TOKEN$/i,
+    /_PASSWORD$/i,
+    /_PASSWD$/i,
+    /(^|_)PWD$/i,
+    /^PGPASSWORD$/i,
+    /_CREDENTIAL/i,
+    /_PRIVATE/i,
+    /_PASSPHRASE$/i,
+    /ACCESS_KEY/i,
+    /_APIKEY$/i,
+    /_DSN$/i,
+    /(^|_)AUTH$/i,
+    /_SALT$/i,
+    /(^|_)SECRETKEY/i,
+    /^ATABEY_AUDIT_HMAC_KEY$/i,
+    /^ATABEY_MASTER_KEY$/i,
+    /^MCP_AUTH_TOKEN$/i,
+    /^MCP_AUTH_USERS$/i,
+    /^DATABASE_URL$/i,
+    /^REDIS_URL$/i,
+    /^OPENAI_API_KEY$/i,
+    /^ANTHROPIC_API_KEY$/i,
+    /^GEMINI_API_KEY$/i,
+    /^GOOGLE_API_KEY$/i,
+    /^AWS_SECRET_ACCESS_KEY$/i,
+    /^AWS_SESSION_TOKEN$/i,
+    /^GITHUB_TOKEN$/i,
+    /^GH_TOKEN$/i,
+    /^GITLAB_TOKEN$/i,
+    /^NPM_TOKEN$/i,
+    /^SLACK_BOT_TOKEN$/i,
+    /^STRIPE_SECRET_KEY$/i,
+];
+const SECRET_LEAK_PATTERNS = [
+    {
+        id: "aws-access-key",
+        description: "AWS Access Key ID",
+        regex: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g,
+    },
+    {
+        id: "github-pat",
+        description: "GitHub Personal Access Token",
+        regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}\b|\bgithub_pat_[A-Za-z0-9_]{80,255}\b/g,
+    },
+    {
+        id: "openai-anthropic-key",
+        description: "OpenAI / Anthropic API Key",
+        regex: /\bsk-(?:proj-|ant-api\d{2}-|live-|test-)?[A-Za-z0-9_-]{20,200}\b/g,
+    },
+    {
+        id: "google-api-key",
+        description: "Google Cloud / Gemini API Key",
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    },
+    {
+        id: "slack-token",
+        description: "Slack API Token",
+        regex: /\bxox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*\b/g,
+    },
+    {
+        id: "private-key-pem",
+        description: "PEM Private Key Block",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g,
+    },
+    {
+        id: "stripe-secret",
+        description: "Stripe Live/Test Secret Key",
+        regex: /\b(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99}\b/g,
+    },
+];
+function deriveSubkey(masterKey, salt) {
+    return Buffer.from(crypto.hkdfSync("sha256", masterKey, salt, Buffer.from("atabey-vault-v1", "utf8"), 32));
+}
+function redactPreview(match) {
+    if (match.length <= 8)
+        return "***";
+    return `${match.slice(0, 4)}...${match.slice(-3)}`;
+}
+export class SecretManager {
+    static resolveVaultDir(customDir) {
+        if (customDir)
+            return customDir;
+        const envDir = process.env.ATABEY_TEST_DIR || process.env.ATABEY_FRAMEWORK_DIR;
+        if (envDir && envDir.trim())
+            return envDir.trim();
+        return resolveFrameworkDir();
+    }
+    static resolveMasterKey(vaultDir) {
+        const envKey = process.env.ATABEY_MASTER_KEY?.trim();
+        if (envKey) {
+            return crypto.createHash("sha256").update(envKey, "utf8").digest();
+        }
+        const keyPath = path.join(vaultDir, "master.key");
+        if (fs.existsSync(keyPath)) {
+            const raw = fs.readFileSync(keyPath);
+            if (raw.length === 32)
+                return raw;
+            return crypto.createHash("sha256").update(raw).digest();
+        }
+        fs.mkdirSync(vaultDir, { recursive: true });
+        const generated = crypto.randomBytes(32);
+        fs.writeFileSync(keyPath, generated, { mode: 0o600 });
+        return generated;
+    }
+    static vaultFilePath(vaultDir) {
+        return path.join(vaultDir, "secrets.vault.json");
+    }
+    static readVault(vaultDir) {
+        const filePath = this.vaultFilePath(vaultDir);
+        if (!fs.existsSync(filePath)) {
+            return { version: 1, entries: {} };
+        }
+        const raw = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        if (!raw || raw.version !== 1 || typeof raw.entries !== "object" || raw.entries === null) {
+            throw new Error("Invalid or unsupported secrets.vault.json format.");
+        }
+        return raw;
+    }
+    static writeVault(vaultDir, vault) {
+        fs.mkdirSync(vaultDir, { recursive: true });
+        const filePath = this.vaultFilePath(vaultDir);
+        const tmpPath = `${filePath}.tmp.${process.pid}`;
+        fs.writeFileSync(tmpPath, JSON.stringify(vault, null, 2), { mode: 0o600 });
+        fs.renameSync(tmpPath, filePath);
+    }
+    /**
+     * Encrypt and store a secret in the local AES-256-GCM vault.
+     */
+    static setSecret(name, value, options = {}) {
+        const keyName = name.trim();
+        if (!keyName || !/^[A-Za-z_][A-Za-z0-9_.-]{0,127}$/.test(keyName)) {
+            throw new Error(`Invalid secret name "${name}". Use alphanumeric, '_', '.', or '-' characters.`);
+        }
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const masterKey = this.resolveMasterKey(vaultDir);
+        const salt = crypto.randomBytes(16);
+        const iv = crypto.randomBytes(12);
+        const subkey = deriveSubkey(masterKey, salt);
+        const cipher = crypto.createCipheriv("aes-256-gcm", subkey, iv);
+        cipher.setAAD(Buffer.from(keyName, "utf8"));
+        const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const vault = this.readVault(vaultDir);
+        const now = new Date().toISOString();
+        const existing = vault.entries[keyName];
+        vault.entries[keyName] = {
+            salt: salt.toString("base64"),
+            iv: iv.toString("base64"),
+            tag: tag.toString("base64"),
+            ciphertext: encrypted.toString("base64"),
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+            description: options.description ?? existing?.description,
+        };
+        this.writeVault(vaultDir, vault);
+    }
+    /**
+     * Retrieve and decrypt a secret by name.
+     * Checks process.env[name] fallback only when allowEnvFallback is true.
+     */
+    static getSecret(name, options = {}) {
+        const keyName = name.trim();
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const vault = this.readVault(vaultDir);
+        const entry = vault.entries[keyName];
+        if (!entry) {
+            if (options.allowEnvFallback && process.env[keyName] !== undefined) {
+                return process.env[keyName] ?? null;
+            }
+            return null;
+        }
+        const masterKey = this.resolveMasterKey(vaultDir);
+        const salt = Buffer.from(entry.salt, "base64");
+        const iv = Buffer.from(entry.iv, "base64");
+        const tag = Buffer.from(entry.tag, "base64");
+        const ciphertext = Buffer.from(entry.ciphertext, "base64");
+        const subkey = deriveSubkey(masterKey, salt);
+        const decipher = crypto.createDecipheriv("aes-256-gcm", subkey, iv);
+        decipher.setAAD(Buffer.from(keyName, "utf8"));
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString("utf8");
+    }
+    /**
+     * Delete a secret from the vault.
+     */
+    static deleteSecret(name, options = {}) {
+        const keyName = name.trim();
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const vault = this.readVault(vaultDir);
+        if (!(keyName in vault.entries))
+            return false;
+        delete vault.entries[keyName];
+        this.writeVault(vaultDir, vault);
+        return true;
+    }
+    /**
+     * List stored secret metadata without exposing plaintext values.
+     */
+    static listSecrets(options = {}) {
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const vault = this.readVault(vaultDir);
+        return Object.entries(vault.entries).map(([name, entry]) => ({
+            name,
+            createdAt: entry.createdAt,
+            updatedAt: entry.updatedAt,
+            description: entry.description,
+        }));
+    }
+    /**
+     * Re-encrypt all vault entries under a new 32-byte master key.
+     *
+     * Safe ordering: decrypt everything first, build the new vault in memory,
+     * then atomically swap. The previous key is kept as `master.key.bak` for
+     * the duration of the swap and restored on failure, so a mid-rotation error
+     * cannot make the vault permanently undecryptable.
+     */
+    static rotateMasterKey(newKeyMaterial, options = {}) {
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        if (process.env.ATABEY_MASTER_KEY?.trim()) {
+            throw new Error("[VAULT] ATABEY_MASTER_KEY is authoritative; file-based rotation is disabled while it is set. " +
+                "Rotate by changing ATABEY_MASTER_KEY and re-running `atabey secrets set` for each secret.");
+        }
+        const vault = this.readVault(vaultDir);
+        const names = Object.keys(vault.entries);
+        if (names.length === 0)
+            return 0;
+        // 1. Decrypt everything with the CURRENT key (no writes yet).
+        const decrypted = names.map((name) => {
+            const value = this.getSecret(name, { vaultDir });
+            if (value === null) {
+                throw new Error(`Failed to decrypt secret "${name}" during key rotation.`);
+            }
+            return {
+                name,
+                value,
+                description: vault.entries[name].description,
+                createdAt: vault.entries[name].createdAt,
+            };
+        });
+        const newMasterKey = typeof newKeyMaterial === "string"
+            ? crypto.createHash("sha256").update(newKeyMaterial, "utf8").digest()
+            : newKeyMaterial.length === 32
+                ? Buffer.from(newKeyMaterial)
+                : crypto.createHash("sha256").update(newKeyMaterial).digest();
+        // 2. Build the new vault in memory, encrypted with the new key.
+        const newEntries = {};
+        const now = new Date().toISOString();
+        for (const item of decrypted) {
+            const salt = crypto.randomBytes(16);
+            const iv = crypto.randomBytes(12);
+            const subkey = deriveSubkey(newMasterKey, salt);
+            const cipher = crypto.createCipheriv("aes-256-gcm", subkey, iv);
+            cipher.setAAD(Buffer.from(item.name, "utf8"));
+            const encrypted = Buffer.concat([cipher.update(item.value, "utf8"), cipher.final()]);
+            newEntries[item.name] = {
+                salt: salt.toString("base64"),
+                iv: iv.toString("base64"),
+                tag: cipher.getAuthTag().toString("base64"),
+                ciphertext: encrypted.toString("base64"),
+                createdAt: item.createdAt,
+                updatedAt: now,
+                description: item.description,
+            };
+        }
+        // 3. Atomically swap key + vault with rollback protection.
+        fs.mkdirSync(vaultDir, { recursive: true });
+        const keyPath = path.join(vaultDir, "master.key");
+        const backupPath = `${keyPath}.bak`;
+        const hadKey = fs.existsSync(keyPath);
+        const oldKey = hadKey ? fs.readFileSync(keyPath) : null;
+        try {
+            if (oldKey)
+                fs.writeFileSync(backupPath, oldKey, { mode: 0o600 });
+            fs.writeFileSync(keyPath, newMasterKey, { mode: 0o600 });
+            this.writeVault(vaultDir, { version: 1, entries: newEntries });
+            if (fs.existsSync(backupPath))
+                fs.unlinkSync(backupPath);
+        }
+        catch (err) {
+            // Restore the previous key so the (unchanged) old vault stays readable.
+            try {
+                if (oldKey)
+                    fs.writeFileSync(keyPath, oldKey, { mode: 0o600 });
+                else if (fs.existsSync(keyPath))
+                    fs.unlinkSync(keyPath);
+                if (fs.existsSync(backupPath))
+                    fs.unlinkSync(backupPath);
+            }
+            catch {
+                /* best-effort rollback */
+            }
+            throw err;
+        }
+        return decrypted.length;
+    }
+}
+/**
+ * Scrub sensitive credentials from an environment object before passing to a child process.
+ */
+export function scrubEnvForSubprocess(env = process.env, extraAllowedKeys = []) {
+    const allowed = new Set(extraAllowedKeys.map((k) => k.toUpperCase()));
+    const clean = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value === undefined)
+            continue;
+        if (allowed.has(key.toUpperCase())) {
+            clean[key] = value;
+            continue;
+        }
+        const isSensitive = SENSITIVE_ENV_PATTERNS.some((re) => re.test(key));
+        if (!isSensitive) {
+            clean[key] = value;
+        }
+    }
+    return clean;
+}
+/**
+ * Scan arbitrary text (command output, file content, tool arguments) for leaked secrets.
+ */
+export function scanForSecrets(text) {
+    if (!text)
+        return [];
+    const findings = [];
+    for (const pattern of SECRET_LEAK_PATTERNS) {
+        pattern.regex.lastIndex = 0;
+        let match;
+        while ((match = pattern.regex.exec(text)) !== null) {
+            findings.push({
+                ruleId: pattern.id,
+                description: pattern.description,
+                matchPreview: redactPreview(match[0]),
+                index: match.index,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Redact leaked secrets from text before it is returned to an AI/LLM.
+ * Complements PII masking with cloud-credential/private-key patterns.
+ */
+export function redactSecrets(text) {
+    if (!text)
+        return text;
+    let out = text;
+    for (const pattern of SECRET_LEAK_PATTERNS) {
+        const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
+        out = out.replace(new RegExp(pattern.regex.source, flags), `[REDACTED:${pattern.id}]`);
+    }
+    return out;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/shared/src/modules/security/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/security/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAsC5D,kFAAkF;AAClF,MAAM,sBAAsB,GAAa;IACrC,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,aAAa;IACb,WAAW;IACX,YAAY;IACZ,eAAe;IACf,cAAc;IACd,WAAW;IACX,eAAe;IACf,aAAa;IACb,WAAW;IACX,QAAQ;IACR,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,0BAA0B;IAC1B,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,sBAAsB;IACtB,iBAAiB;IACjB,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,sBAAsB;CACzB,CAAC;AAQF,MAAM,oBAAoB,GAAwB;IAC9C;QACI,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,mBAAmB;QAChC,KAAK,EAAE,0CAA0C;KACpD;IACD;QACI,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,8BAA8B;QAC3C,KAAK,EAAE,sFAAsF;KAChG;IACD;QACI,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,4BAA4B;QACzC,KAAK,EAAE,mEAAmE;KAC7E;IACD;QACI,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,+BAA+B;QAC5C,KAAK,EAAE,4BAA4B;KACtC;IACD;QACI,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,iBAAiB;QAC9B,KAAK,EAAE,wDAAwD;KAClE;IACD;QACI,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,oEAAoE;KAC9E;IACD;QACI,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,6BAA6B;QAC1C,KAAK,EAAE,iDAAiD;KAC3D;CACJ,CAAC;AAEF,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAY;IACjD,OAAO,MAAM,CAAC,IAAI,CACd,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CACzF,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,aAAa;IACd,MAAM,CAAC,eAAe,CAAC,SAAkB;QAC7C,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC/E,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,mBAAmB,EAAE,CAAC;IACjC,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,QAAgB;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC;YAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,QAAgB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACrD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAc,CAAC;QACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,QAAgB,EAAE,KAAgB;QACxD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CACnB,IAAY,EACZ,KAAa,EACb,UAAuD,EAAE;QAEzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,mDAAmD,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAExC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;YACrB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;SAC5D,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,SAAS,CACnB,IAAY,EACZ,UAA6D,EAAE;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;YACxC,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,UAAiC,EAAE;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,UAAiC,EAAE;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,eAAe,CAAC,cAA+B,EAAE,UAAiC,EAAE;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACX,+FAA+F;gBAC/F,2FAA2F,CAC9F,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEjC,8DAA8D;QAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,wBAAwB,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO;gBACH,IAAI;gBACJ,KAAK;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW;gBAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS;aAC3C,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GACd,OAAO,cAAc,KAAK,QAAQ;YAC9B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE;YACrE,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,EAAE;gBAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC7B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;QAExE,gEAAgE;QAChE,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrF,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACpB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,GAAG;gBACd,WAAW,EAAE,IAAI,CAAC,WAAW;aAChC,CAAC;QACN,CAAC;QAED,2DAA2D;QAC3D,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,OAAO,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,IAAI,CAAC;YACD,IAAI,MAAM;gBAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,IAAI,CAAC;gBACD,IAAI,MAAM;oBAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACL,0BAA0B;YAC9B,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC;IAC5B,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAAyB,OAAO,CAAC,GAAG,EACpC,mBAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAsB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,SAAS;QACb,CAAC;QACD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,OAAO,CAAC,EAAE;gBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;aACrB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAClG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,aAAa,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/shared/src/modules/security/tls.d.ts

@@ -0,0 +1,87 @@
+/**
+ * TLS 1.3 / mTLS transport security for Atabey HTTP + WebSocket servers.
+ *
+ * All network-facing servers (MCP unified server) go through
+ * `createHttpOrHttpsServer()` so encryption is applied uniformly.
+ *
+ * Environment:
+ *   ATABEY_TLS_ENABLED=auto|true|false   (auto = enabled when cert+key set)
+ *   ATABEY_TLS_CERT_FILE=/path/cert.pem  (server certificate, PEM)
+ *   ATABEY_TLS_KEY_FILE=/path/key.pem    (server private key, PEM)
+ *   ATABEY_TLS_CA_FILE=/path/ca.pem      (CA bundle; required for mTLS)
+ *   ATABEY_TLS_MIN_VERSION=TLSv1.3       (TLSv1.3 | TLSv1.2)
+ *   ATABEY_MTLS_REQUIRED=true            (require + verify client certificates)
+ *   ATABEY_TLS_REQUIRED=true             (fail hard if TLS not configured)
+ *   ATABEY_ALLOW_INSECURE_BIND=true      (allow plaintext on non-loopback host)
+ *
+ * Cipher suites are left to Node's secure defaults, which already prefer
+ * TLS 1.3 (AES-256-GCM / CHACHA20-POLY1305). We additionally enforce a modern
+ * minimum version and disable session tickets for HITL-sensitive traffic.
+ */
+import http from "http";
+import https from "https";
+export type TlsMinVersion = "TLSv1.2" | "TLSv1.3";
+export interface ResolvedTlsConfig {
+    /** Whether the server will actually listen over TLS. */
+    enabled: boolean;
+    minVersion: TlsMinVersion;
+    mtlsRequired: boolean;
+    /** ATABEY_TLS_REQUIRED — hard-fail when TLS is not configured. */
+    required: boolean;
+    certFile?: string;
+    keyFile?: string;
+    caFile?: string;
+    /** Present only when enabled. */
+    serverOptions?: https.ServerOptions;
+}
+/**
+ * Resolve the TLS configuration from environment. Throws when TLS is enabled
+ * but the certificate material is missing/invalid, or when mTLS is required
+ * without a CA bundle.
+ */
+export declare function resolveTlsConfig(): ResolvedTlsConfig;
+/**
+ * Outbound (client) TLS options for HTTPS requests made by Atabey tooling.
+ *
+ * Environment:
+ *   ATABEY_TLS_CLIENT_CERT_FILE=/path/client.crt   (mTLS client certificate)
+ *   ATABEY_TLS_CLIENT_KEY_FILE=/path/client.key    (mTLS client key)
+ *   ATABEY_TLS_CLIENT_CA_FILE=/path/ca.pem         (custom CA bundle)
+ *   ATABEY_TLS_CLIENT_MIN_VERSION=TLSv1.3
+ *   ATABEY_TLS_CLIENT_SERVERNAME=api.example.com   (optional SNI override)
+ */
+export interface OutboundTlsConfig {
+    enabled: boolean;
+    minVersion: TlsMinVersion;
+    options: {
+        cert?: Buffer;
+        key?: Buffer;
+        ca?: Buffer;
+        minVersion?: TlsMinVersion;
+        servername?: string;
+    };
+}
+export declare function resolveOutboundTlsOptions(): OutboundTlsConfig;
+/**
+ * Create an HTTPS server when TLS is configured, otherwise a plain HTTP server.
+ * Both server types satisfy `http.Server`, so callers stay type-safe.
+ */
+export declare function createHttpOrHttpsServer(tls: ResolvedTlsConfig, handler: http.RequestListener): http.Server;
+/**
+ * Human-readable description for logs / `/mcp/health`.
+ */
+export declare function describeTls(tls: ResolvedTlsConfig): string;
+/**
+ * Enforce the transport-security policy before binding.
+ *
+ * - If ATABEY_TLS_REQUIRED=true and TLS is not configured → throw (fail closed).
+ * - If binding to a non-loopback host over plaintext → throw unless
+ *   ATABEY_ALLOW_INSECURE_BIND=true (prevents accidental public plaintext).
+ */
+export declare function assertTransportSecurity(tls: ResolvedTlsConfig, host: string, opts?: {
+    allowInsecureBind?: boolean;
+}): void;
+/** The scheme clients should use to reach this server. */
+export declare function tlsScheme(tls: ResolvedTlsConfig): "https" | "http";
+/** The WebSocket scheme clients should use. */
+export declare function wsScheme(tls: ResolvedTlsConfig): "wss" | "ws";

package/dist/shared/src/modules/security/tls.js

@@ -0,0 +1,154 @@
+/**
+ * TLS 1.3 / mTLS transport security for Atabey HTTP + WebSocket servers.
+ *
+ * All network-facing servers (MCP unified server) go through
+ * `createHttpOrHttpsServer()` so encryption is applied uniformly.
+ *
+ * Environment:
+ *   ATABEY_TLS_ENABLED=auto|true|false   (auto = enabled when cert+key set)
+ *   ATABEY_TLS_CERT_FILE=/path/cert.pem  (server certificate, PEM)
+ *   ATABEY_TLS_KEY_FILE=/path/key.pem    (server private key, PEM)
+ *   ATABEY_TLS_CA_FILE=/path/ca.pem      (CA bundle; required for mTLS)
+ *   ATABEY_TLS_MIN_VERSION=TLSv1.3       (TLSv1.3 | TLSv1.2)
+ *   ATABEY_MTLS_REQUIRED=true            (require + verify client certificates)
+ *   ATABEY_TLS_REQUIRED=true             (fail hard if TLS not configured)
+ *   ATABEY_ALLOW_INSECURE_BIND=true      (allow plaintext on non-loopback host)
+ *
+ * Cipher suites are left to Node's secure defaults, which already prefer
+ * TLS 1.3 (AES-256-GCM / CHACHA20-POLY1305). We additionally enforce a modern
+ * minimum version and disable session tickets for HITL-sensitive traffic.
+ */
+import fs from "fs";
+import http from "http";
+import https from "https";
+function envBool(key, fallback = false) {
+    const v = process.env[key];
+    if (v === undefined)
+        return fallback;
+    return v === "true" || v === "1" || v === "yes";
+}
+/**
+ * Resolve the TLS configuration from environment. Throws when TLS is enabled
+ * but the certificate material is missing/invalid, or when mTLS is required
+ * without a CA bundle.
+ */
+export function resolveTlsConfig() {
+    const certFile = process.env.ATABEY_TLS_CERT_FILE?.trim() || undefined;
+    const keyFile = process.env.ATABEY_TLS_KEY_FILE?.trim() || undefined;
+    const caFile = process.env.ATABEY_TLS_CA_FILE?.trim() || undefined;
+    const mtlsRequired = envBool("ATABEY_MTLS_REQUIRED", false);
+    const required = envBool("ATABEY_TLS_REQUIRED", false);
+    const minVersion = (process.env.ATABEY_TLS_MIN_VERSION?.trim() || "TLSv1.3");
+    if (minVersion !== "TLSv1.2" && minVersion !== "TLSv1.3") {
+        throw new Error(`[TLS] Invalid ATABEY_TLS_MIN_VERSION "${minVersion}" (use TLSv1.2 or TLSv1.3).`);
+    }
+    const hasKeyPair = Boolean(certFile && keyFile);
+    const explicit = process.env.ATABEY_TLS_ENABLED;
+    const enabled = explicit === undefined ? hasKeyPair : envBool("ATABEY_TLS_ENABLED", hasKeyPair);
+    if (!enabled) {
+        return { enabled: false, minVersion, mtlsRequired, required, certFile, keyFile, caFile };
+    }
+    if (!certFile || !keyFile) {
+        throw new Error("[TLS] ATABEY_TLS_ENABLED is set but ATABEY_TLS_CERT_FILE / ATABEY_TLS_KEY_FILE are missing.");
+    }
+    for (const f of [certFile, keyFile]) {
+        if (!fs.existsSync(f))
+            throw new Error(`[TLS] Certificate file not found: ${f}`);
+    }
+    if (mtlsRequired && !caFile) {
+        throw new Error("[TLS] ATABEY_MTLS_REQUIRED=true requires ATABEY_TLS_CA_FILE (client CA bundle).");
+    }
+    if (caFile && !fs.existsSync(caFile)) {
+        throw new Error(`[TLS] CA file not found: ${caFile}`);
+    }
+    const serverOptions = {
+        minVersion,
+        cert: fs.readFileSync(certFile),
+        key: fs.readFileSync(keyFile),
+        honorCipherOrder: true,
+        // Avoid stale TLS sessions after key rotation.
+        sessionTimeout: 0,
+    };
+    if (caFile)
+        serverOptions.ca = fs.readFileSync(caFile);
+    if (mtlsRequired) {
+        serverOptions.requestCert = true;
+        serverOptions.rejectUnauthorized = true;
+    }
+    return { enabled: true, minVersion, mtlsRequired, required, certFile, keyFile, caFile, serverOptions };
+}
+export function resolveOutboundTlsOptions() {
+    const certFile = process.env.ATABEY_TLS_CLIENT_CERT_FILE?.trim() || undefined;
+    const keyFile = process.env.ATABEY_TLS_CLIENT_KEY_FILE?.trim() || undefined;
+    const caFile = process.env.ATABEY_TLS_CLIENT_CA_FILE?.trim() || undefined;
+    const minVersion = (process.env.ATABEY_TLS_CLIENT_MIN_VERSION?.trim() || "TLSv1.3");
+    const servername = process.env.ATABEY_TLS_CLIENT_SERVERNAME?.trim() || undefined;
+    if (minVersion !== "TLSv1.2" && minVersion !== "TLSv1.3") {
+        throw new Error(`[TLS] Invalid ATABEY_TLS_CLIENT_MIN_VERSION "${minVersion}".`);
+    }
+    if ((certFile && !keyFile) || (keyFile && !certFile)) {
+        throw new Error("[TLS] Outbound mTLS requires BOTH ATABEY_TLS_CLIENT_CERT_FILE and ATABEY_TLS_CLIENT_KEY_FILE.");
+    }
+    for (const f of [certFile, keyFile, caFile]) {
+        if (f && !fs.existsSync(f))
+            throw new Error(`[TLS] Outbound certificate file not found: ${f}`);
+    }
+    const enabled = Boolean(certFile || keyFile || caFile);
+    const options = { minVersion };
+    if (certFile)
+        options.cert = fs.readFileSync(certFile);
+    if (keyFile)
+        options.key = fs.readFileSync(keyFile);
+    if (caFile)
+        options.ca = fs.readFileSync(caFile);
+    if (servername)
+        options.servername = servername;
+    return { enabled, minVersion, options };
+}
+/**
+ * Create an HTTPS server when TLS is configured, otherwise a plain HTTP server.
+ * Both server types satisfy `http.Server`, so callers stay type-safe.
+ */
+export function createHttpOrHttpsServer(tls, handler) {
+    if (tls.enabled && tls.serverOptions) {
+        return https.createServer(tls.serverOptions, handler);
+    }
+    return http.createServer(handler);
+}
+/**
+ * Human-readable description for logs / `/mcp/health`.
+ */
+export function describeTls(tls) {
+    if (!tls.enabled)
+        return "disabled (plaintext)";
+    return `${tls.minVersion}${tls.mtlsRequired ? " + mTLS (client cert required)" : ""}`;
+}
+/**
+ * Enforce the transport-security policy before binding.
+ *
+ * - If ATABEY_TLS_REQUIRED=true and TLS is not configured → throw (fail closed).
+ * - If binding to a non-loopback host over plaintext → throw unless
+ *   ATABEY_ALLOW_INSECURE_BIND=true (prevents accidental public plaintext).
+ */
+export function assertTransportSecurity(tls, host, opts = {}) {
+    if (tls.required && !tls.enabled) {
+        throw new Error("[TLS] ATABEY_TLS_REQUIRED=true but TLS is not configured. " +
+            "Provide ATABEY_TLS_CERT_FILE / ATABEY_TLS_KEY_FILE (and ATABEY_TLS_CA_FILE for mTLS).");
+    }
+    const normalized = host.replace(/^\[|\]$/g, "");
+    const isLoopback = normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
+    const allowInsecure = opts.allowInsecureBind ?? envBool("ATABEY_ALLOW_INSECURE_BIND", false);
+    if (!tls.enabled && !isLoopback && !allowInsecure) {
+        throw new Error(`[TLS] Refusing to bind plaintext HTTP to "${host}" (non-loopback). ` +
+            "Configure TLS (ATABEY_TLS_CERT_FILE/KEY_FILE) or set ATABEY_ALLOW_INSECURE_BIND=true.");
+    }
+}
+/** The scheme clients should use to reach this server. */
+export function tlsScheme(tls) {
+    return tls.enabled ? "https" : "http";
+}
+/** The WebSocket scheme clients should use. */
+export function wsScheme(tls) {
+    return tls.enabled ? "wss" : "ws";
+}
+//# sourceMappingURL=tls.js.map

package/dist/shared/src/modules/security/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/security/tls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAkB1B,SAAS,OAAO,CAAC,GAAW,EAAE,QAAQ,GAAG,KAAK;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAkB,CAAC;IAE9F,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,6BAA6B,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAEhG,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAwB;QACvC,UAAU;QACV,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC/B,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;QAC7B,gBAAgB,EAAE,IAAI;QACtB,+CAA+C;QAC/C,cAAc,EAAE,CAAC;KACpB,CAAC;IACF,IAAI,MAAM;QAAE,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QACf,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC;QACjC,aAAa,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC3G,CAAC;AAwBD,MAAM,UAAU,yBAAyB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAkB,CAAC;IACrG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAEjF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,UAAU,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACrH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,IAAI,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAiC,EAAE,UAAU,EAAE,CAAC;IAC7D,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,UAAU;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAChD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACnC,GAAsB,EACtB,OAA6B;IAE7B,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAsB;IAC9C,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,sBAAsB,CAAC;IAChD,OAAO,GAAG,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,GAAsB,EACtB,IAAY,EACZ,OAAwC,EAAE;IAE1C,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACX,4DAA4D;YAC5D,uFAAuF,CAC1F,CAAC;IACN,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,WAAW,CAAC;IACpG,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACX,6CAA6C,IAAI,oBAAoB;YACrE,uFAAuF,CAC1F,CAAC;IACN,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,GAAsB;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,QAAQ,CAAC,GAAsB;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC"}

package/dist/shared/src/modules/storage/database.d.ts

@@ -0,0 +1,6 @@
+import type Database from "better-sqlite3";
+export declare const databaseHolder: {
+    setDB(db: Database.Database): void;
+    getDB(): Database.Database;
+    hasDB(): boolean;
+};

package/dist/shared/src/modules/storage/database.js

@@ -0,0 +1,16 @@
+let globalDB = null;
+export const databaseHolder = {
+    setDB(db) {
+        globalDB = db;
+    },
+    getDB() {
+        if (!globalDB) {
+            throw new Error("Atabey Shared Database has not been initialized. Please call databaseHolder.setDB(db) at startup.");
+        }
+        return globalDB;
+    },
+    hasDB() {
+        return globalDB !== null;
+    }
+};
+//# sourceMappingURL=database.js.map