hazo_secure 1.1.0 → 1.4.0

package/CHANGE_LOG.md

@@ -1,5 +1,35 @@
 # Change Log
 
+## 1.4.0 — 2026-07-12
+
+### New: `hazo_secure/crypto` — generic HMAC sign/verify primitive
+
+- **`signHmac(payload, secret)`** — signs an arbitrary UTF-8 payload string
+  with HMAC-SHA256, returning a `<payloadB64url>.<sigB64url>` token. No
+  expiry/claims logic — callers put their own JSON in the payload and handle
+  their own expiry/revocation.
+- **`verifyHmac(token, secret)`** — constant-time verification via
+  `timingSafeEqual`, with a length pre-check on the signature against a
+  fixed constant before comparing, and a caught missing/empty-secret path
+  that fails closed with `{ valid: false, reason: "malformed" }` instead of
+  throwing. Returns `{ valid: true, payload }` with the decoded original
+  payload string on success.
+- **`HmacVerifyResult`** type: `{ valid: true; payload: string } | { valid: false; reason: "malformed" | "signature_mismatch" }`.
+- Dependency-free (only `node:crypto`); added to the existing `./crypto`
+  subpath export, no new subpath. Motivated by `hazo_embed`'s need for
+  domain-locked embed-key token signing, but kept fully generic.
+
+## 1.3.0 — 2026-06-12
+
+### New: `hazo_secure/secrets` — SecretsProvider
+
+- **`SecretsProvider` interface** with `get(name)` / `resolve(names[])` methods.
+- **`EnvSecretsProvider`** — reads from env vars (`${prefix}_${NAME}`; default prefix `HAZO_SECRET`).
+- **`StaticSecretsProvider`** — in-memory map; primary use is tests.
+- **`LookupSecretsProvider`** — caller-supplied `(name) => string|undefined` function.
+- **`SecretsError`** — extends `HazoError`, code `HAZO_SECURE_SECRET_NOT_FOUND` (httpStatus 400, retryable false).
+- New `./secrets` subpath export.
+
 ## 1.1.0 — 2026-05-29
 
 ### hazo workspace v2 — Wave 2 migration

package/README.md

@@ -1,6 +1,6 @@
 # hazo_secure
 
-Security & compliance primitives for Node.js / Next.js apps. Four independent subpath modules — import only the ones you need.
+Security & compliance primitives for Node.js / Next.js apps. Seven independent subpath modules — import only the ones you need.
 
 | Subpath | Purpose |
 |---|---|
@@ -9,6 +9,8 @@ Security & compliance primitives for Node.js / Next.js apps. Four independent su
 | `hazo_secure/crypto` | AES-256-GCM field-level encryption with key versioning and AAD support |
 | `hazo_secure/gdpr` | Exporter / anonymiser registry + lifecycle orchestrator. Uses `hazo_jobs` for async export, `hazo_files` for ZIP delivery |
 | `hazo_secure/csrf` | Double-submit CSRF protection for Next.js routes — token generation, cookie header, constant-time verification |
+| `hazo_secure/mask` | PII masking and anonymization transforms (redact, hash, tokenize, fake_name, jitter_date, …) |
+| `hazo_secure/secrets` | Provider-pattern secret resolution — env vars, static map, or custom lookup |
 
 ## Install
 
@@ -16,7 +18,7 @@ Security & compliance primitives for Node.js / Next.js apps. Four independent su
 npm install hazo_secure
 ```
 
-`hazo_logs` is a required peer dep. `hazo_connect`, `hazo_jobs`, and `hazo_files` are optional peers — `hazo_connect` is needed for `ConnectRateLimitStore`; `hazo_jobs` and `hazo_files` are only needed for `hazo_secure/gdpr`.
+`hazo_core` is a required peer dep. `hazo_logs`, `hazo_connect`, `hazo_jobs`, `hazo_files`, and `hazo_ui` are optional peers — `hazo_connect` is needed for `ConnectRateLimitStore`; `hazo_jobs` and `hazo_files` are only needed for `hazo_secure/gdpr`.
 
 ## Quick start
 
@@ -56,6 +58,24 @@ const stored = await encryptField(plaintext, { keys, aad: `user:${userId}` });
 const recovered = await decryptField(stored, { keys });
 ```
 
+### Resolve application secrets
+
+```ts
+import { EnvSecretsProvider, StaticSecretsProvider, LookupSecretsProvider } from "hazo_secure/secrets";
+
+// Reads from env vars: HAZO_SECRET_DB_PASSWORD, HAZO_SECRET_STRIPE_KEY, …
+const secrets = new EnvSecretsProvider();
+const { db_password, stripe_key } = await secrets.resolve(["db_password", "stripe_key"]);
+
+// Tests — in-memory map
+const mock = new StaticSecretsProvider({ api_key: "test-key" });
+
+// Custom backend (KMS, HashiCorp Vault, etc.)
+const vault = new LookupSecretsProvider(async (name) => fetchFromVault(name));
+```
+
+`SecretsError` (code `HAZO_SECURE_SECRET_NOT_FOUND`) is thrown when a name can't be resolved. Use a custom prefix: `new EnvSecretsProvider("MY_APP")` → reads `MY_APP_<NAME>`.
+
 ### Register GDPR exporters
 
 ```ts
@@ -152,6 +172,8 @@ await gdpr.anonymiseUser({ userId });
 | `hazo_secure/fetch` | ⚠️ pre-flight only | ✅ full protection | Edge: host/IP checks only; Node: + undici connect-time validation |
 | `hazo_secure/crypto` | ❌ | ✅ | Uses `node:crypto` |
 | `hazo_secure/gdpr` | ❌ | ✅ | Async iterables + optional hazo_connect |
+| `hazo_secure/mask` | ✅ | ✅ | Pure transforms — no I/O |
+| `hazo_secure/secrets` | ✅ | ✅ | Pure async — no Node built-ins |
 
 **Node.js ≥ 18 required** for all Node-only subpaths.
 

package/SETUP_CHECKLIST.md

@@ -34,6 +34,20 @@ Default in-memory store works out of the box. For multi-instance deployments, su
    - **Custom** — implement the `KeyProvider` interface directly
 3. Decide AAD scheme — usually `domain:entityId` (e.g. `health:${personId}`)
 
+### `hazo_secure/secrets`
+
+No setup. Choose a provider at startup:
+
+- **`EnvSecretsProvider(prefix?)`** — reads from `${prefix}_${NAME}` env vars (default prefix: `HAZO_SECRET`). Set each secret as an env var on your deployment platform.
+- **`StaticSecretsProvider(map)`** — in-memory; use in tests only.
+- **`LookupSecretsProvider(fn)`** — caller-supplied sync or async lookup; useful for KMS / Vault integrations.
+
+```ts
+import { EnvSecretsProvider } from "hazo_secure/secrets";
+const secrets = new EnvSecretsProvider();
+const value = await secrets.get("db_password"); // reads HAZO_SECRET_DB_PASSWORD
+```
+
 ### `hazo_secure/gdpr`
 
 1. Install optional peers if you'll use async export and ZIP delivery:
@@ -65,4 +79,7 @@ node --input-type=module -e "import * as m from 'hazo_secure/crypto'; console.lo
 
 # GDPR — expect: createGdprRegistry, GdprRegistryError
 node --input-type=module -e "import * as m from 'hazo_secure/gdpr'; console.log(Object.keys(m).join(', '))"
+
+# Secrets — expect: SecretsError, SecretsProvider (type), EnvSecretsProvider, StaticSecretsProvider, LookupSecretsProvider
+node --input-type=module -e "import * as m from 'hazo_secure/secrets'; console.log(Object.keys(m).join(', '))"
 ```

package/dist/crypto/index.d.ts

@@ -31,6 +31,30 @@ declare class HttpKeyProvider implements KeyProvider {
     clearCache(): void;
 }
 
+/**
+ * Sign an arbitrary UTF-8 payload string with HMAC-SHA256, returning a
+ * `<payloadB64url>.<sigB64url>` token. The payload is opaque to this
+ * module — callers put their own JSON (or any string) in it and are
+ * responsible for their own expiry/revocation semantics; this primitive
+ * only proves the payload wasn't tampered with and was signed under `secret`.
+ */
+declare function signHmac(payload: string, secret: string): string;
+type HmacVerifyResult = {
+    valid: true;
+    payload: string;
+} | {
+    valid: false;
+    reason: "malformed" | "signature_mismatch";
+};
+/**
+ * Verify a token produced by `signHmac`. Constant-time signature comparison
+ * via `timingSafeEqual`, with a length pre-check against a fixed constant
+ * (not secret-dependent) so short/garbage signatures never reach the
+ * timing-safe path. Fails closed — never throws, even for a missing/empty
+ * `secret` or a malformed token.
+ */
+declare function verifyHmac(token: string, secret: string): HmacVerifyResult;
+
 /**
  * Source of symmetric keys for `encryptField` / `decryptField`. The current
  * key is used for encryption; `byId` resolves any key (current or rotated-out)
@@ -140,8 +164,41 @@ declare class StaticKeyProvider implements KeyProvider {
     }>;
     byId(keyId: string): Promise<Uint8Array>;
 }
+/**
+ * Lookup-function-backed `KeyProvider` for config-file (INI) key sources.
+ * Reads keys from a caller-supplied synchronous lookup function, decoding
+ * each value from base64 to a 32-byte AES-256 key.
+ *
+ * Expected key naming convention (mirrors hazo_config INI layout):
+ *   `current`      → the current key id (e.g. `"v1"`)
+ *   `key_<id>`     → base64-encoded 32-byte key (e.g. `key_v1=<base64>`)
+ *
+ * Example backed by hazo_config:
+ *   ```ts
+ *   const cfg = getConfig('crypto.myapp');  // hazo_config, not imported here
+ *   const keys = new LookupKeyProvider(name => cfg.get(name));
+ *   ```
+ *
+ * hazo_secure takes no dependency on hazo_config — the caller supplies the
+ * lookup, keeping this library config-agnostic. `Buffer.from(value, 'base64')`
+ * handles standard base64; keys decoded to anything other than 32 bytes are
+ * rejected with `invalid_key`.
+ *
+ * Decoded keys are memoised per id so the lookup runs once per key per
+ * process lifetime.
+ */
+declare class LookupKeyProvider implements KeyProvider {
+    private readonly lookup;
+    private readonly cache;
+    constructor(lookup: (name: string) => string | undefined);
+    current(): Promise<{
+        keyId: string;
+        key: Uint8Array;
+    }>;
+    byId(keyId: string): Promise<Uint8Array>;
+}
 /** Helper: build a `aad` string with a stable, parser-friendly shape.
  *  Convention: `<table>:<entityId>:<field>` — collision-free across tables. */
 declare function aadFor(table: string, entityId: string, field: string): string;
 
-export { CryptoError, type CryptoErrorCode, type EncryptedField, EnvKeyProvider, HttpKeyProvider, type HttpKeyProviderOptions, type KeyProvider, StaticKeyProvider, aadFor, decryptField, encryptField };
+export { CryptoError, type CryptoErrorCode, type EncryptedField, EnvKeyProvider, type HmacVerifyResult, HttpKeyProvider, type HttpKeyProviderOptions, type KeyProvider, LookupKeyProvider, StaticKeyProvider, aadFor, decryptField, encryptField, signHmac, verifyHmac };

package/dist/crypto/index.js

@@ -79,6 +79,55 @@ var HttpKeyProvider = class {
   }
 };
 
+// src/crypto/hmac.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var HMAC_B64URL_LEN = 43;
+function b64url(input) {
+  const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+  return buf.toString("base64").replace(/=+$/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function b64urlDecode(input) {
+  const pad = input.length % 4 === 0 ? "" : "=".repeat(4 - input.length % 4);
+  return Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+function sign(payloadB64, secret) {
+  if (!secret) throw new Error("hazo_secure/crypto: HMAC secret is not set");
+  return b64url(createHmac("sha256", secret).update(payloadB64).digest());
+}
+function signHmac(payload, secret) {
+  const payloadB64 = b64url(payload);
+  const sig = sign(payloadB64, secret);
+  return `${payloadB64}.${sig}`;
+}
+function verifyHmac(token, secret) {
+  if (!secret) return { valid: false, reason: "malformed" };
+  if (!token || typeof token !== "string") return { valid: false, reason: "malformed" };
+  const parts = token.split(".");
+  if (parts.length !== 2) return { valid: false, reason: "malformed" };
+  const [payloadB64, sig] = parts;
+  if (sig.length !== HMAC_B64URL_LEN) {
+    return { valid: false, reason: "signature_mismatch" };
+  }
+  let expectedSig;
+  try {
+    expectedSig = sign(payloadB64, secret);
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  const a = Buffer.from(sig);
+  const b = Buffer.from(expectedSig);
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    return { valid: false, reason: "signature_mismatch" };
+  }
+  let payload;
+  try {
+    payload = b64urlDecode(payloadB64).toString("utf8");
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  return { valid: true, payload };
+}
+
 // src/crypto/index.ts
 var CryptoError = class extends HazoError {
   constructor(message, code) {
@@ -218,6 +267,44 @@ var StaticKeyProvider = class {
     return key;
   }
 };
+var LookupKeyProvider = class {
+  constructor(lookup) {
+    this.lookup = lookup;
+  }
+  lookup;
+  cache = /* @__PURE__ */ new Map();
+  async current() {
+    const keyId = this.lookup("current");
+    if (!keyId) {
+      throw new CryptoError(
+        "LookupKeyProvider: no 'current' key id from lookup",
+        "missing_env_key"
+      );
+    }
+    const key = await this.byId(keyId);
+    return { keyId, key };
+  }
+  async byId(keyId) {
+    if (this.cache.has(keyId)) return this.cache.get(keyId);
+    const lookupName = `key_${keyId}`;
+    const raw = this.lookup(lookupName);
+    if (!raw) {
+      throw new CryptoError(
+        `LookupKeyProvider: no key material for id ${keyId} (looked up "${lookupName}")`,
+        "key_not_found"
+      );
+    }
+    const buf = Buffer.from(raw, "base64");
+    if (buf.byteLength !== KEY_LEN2) {
+      throw new CryptoError(
+        `${lookupName} decodes to ${buf.byteLength} bytes; AES-256-GCM needs ${KEY_LEN2}`,
+        "invalid_key"
+      );
+    }
+    this.cache.set(keyId, buf);
+    return buf;
+  }
+};
 function aadFor(table, entityId, field) {
   return `${table}:${entityId}:${field}`;
 }
@@ -225,8 +312,11 @@ export {
   CryptoError,
   EnvKeyProvider,
   HttpKeyProvider,
+  LookupKeyProvider,
   StaticKeyProvider,
   aadFor,
   decryptField,
-  encryptField
+  encryptField,
+  signHmac,
+  verifyHmac
 };

package/dist/mask/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * mask_email — replace with deterministic masked email.
+ * alice@example.com → a3f9b12c1d2e@masked.example
+ * Same source → same masked value (FK survival).
+ */
+declare function mask_email(value: unknown, _col: string, maskKey: string): unknown;
+/**
+ * mask_phone — replace with deterministic masked phone.
+ * Preserves leading + and length pattern. +1-555-0001 → +1-XXX-a3f9b1
+ */
+declare function mask_phone(value: unknown, _col: string, maskKey: string): unknown;
+declare function fake_name(value: unknown, _col: string, maskKey: string): unknown;
+/**
+ * jitter_date — add a deterministic date offset (±0–180 days) to a date string.
+ * Preserves approximate era; different source values → different offsets.
+ */
+declare function jitter_date(value: unknown, _col: string, maskKey: string): unknown;
+/**
+ * hash — replace with HMAC-SHA256 hex hash of value.
+ * Fully opaque; same source → same hash.
+ */
+declare function hash(value: unknown, col: string, maskKey: string): unknown;
+/**
+ * tokenize — replace with a stable short token (FK-safe).
+ * tok_<12 hex chars> — same source → same token.
+ */
+declare function tokenize(value: unknown, col: string, maskKey: string): unknown;
+/**
+ * drop — always returns null (secret dropped, not masked).
+ * Used for passwords, tokens, etc.
+ */
+declare function drop(_value: unknown, _col: string, _maskKey: string): unknown;
+/**
+ * nullify — replace with null (less aggressive than drop; preserves column semantics).
+ */
+declare function nullify(_value: unknown, _col: string, _maskKey: string): unknown;
+/**
+ * redact_pii — NER-based PII redaction (wink-nlp lite model).
+ * Detects named entities (dates, cardinals, etc.) and replaces them with [REDACTED_TYPE].
+ * Deterministic: same input + same model → same output.
+ * maskKey is accepted but not used (redaction is model-driven, not key-driven).
+ */
+declare function redact_pii(value: unknown, _col: string, _maskKey: string): unknown;
+/** Registry of all built-in transforms */
+declare const BUILTIN_TRANSFORMS: Record<string, (value: unknown, col: string, maskKey: string) => unknown>;
+type MaskTransformFn = (value: unknown, col: string, maskKey: string) => unknown;
+
+export { BUILTIN_TRANSFORMS, type MaskTransformFn, drop, fake_name, hash, jitter_date, mask_email, mask_phone, nullify, redact_pii, tokenize };

package/dist/mask/index.js

@@ -0,0 +1,115 @@
+// src/mask/index.ts
+import { createHmac } from "crypto";
+import { createRequire } from "module";
+function hmacHex(value, maskKey, context) {
+  return createHmac("sha256", maskKey).update(`${context}:${value}`).digest("hex");
+}
+function hmacToken(value, maskKey, context) {
+  return hmacHex(value, maskKey, context).slice(0, 12);
+}
+function mask_email(value, _col, maskKey) {
+  if (value === null || value === void 0) return value;
+  const str = String(value);
+  const atIdx = str.indexOf("@");
+  const domain = atIdx >= 0 ? str.slice(atIdx + 1) : "example.com";
+  const token = hmacToken(str, maskKey, "email");
+  return `${token}@masked.${domain}`;
+}
+function mask_phone(value, _col, maskKey) {
+  if (value === null || value === void 0) return value;
+  const str = String(value);
+  const token = hmacToken(str, maskKey, "phone").slice(0, 6);
+  const hasPlus = str.startsWith("+");
+  const digits = str.replace(/[^\d]/g, "");
+  const prefix = digits.length > 4 ? digits.slice(0, 2) : "00";
+  return `${hasPlus ? "+" : ""}${prefix}-XXX-${token}`;
+}
+var FIRST_NAMES = ["Alex", "Blake", "Casey", "Dana", "Ellis", "Finley", "Gray", "Harper", "Indigo", "Jordan"];
+var LAST_NAMES = ["Smith", "Jones", "Williams", "Brown", "Davis", "Miller", "Wilson", "Moore", "Taylor", "Anderson"];
+function fake_name(value, _col, maskKey) {
+  if (value === null || value === void 0) return value;
+  const str = String(value);
+  const h = hmacHex(str, maskKey, "name");
+  const firstIdx = parseInt(h.slice(0, 2), 16) % FIRST_NAMES.length;
+  const lastIdx = parseInt(h.slice(2, 4), 16) % LAST_NAMES.length;
+  return `${FIRST_NAMES[firstIdx]} ${LAST_NAMES[lastIdx]}`;
+}
+function jitter_date(value, _col, maskKey) {
+  if (value === null || value === void 0) return value;
+  const str = String(value);
+  const h = hmacHex(str, maskKey, "date");
+  const jitterDays = parseInt(h.slice(0, 4), 16) % 361 - 180;
+  const date = new Date(str);
+  if (isNaN(date.getTime())) return value;
+  date.setDate(date.getDate() + jitterDays);
+  return date.toISOString().slice(0, 10);
+}
+function hash(value, col, maskKey) {
+  if (value === null || value === void 0) return value;
+  return hmacHex(String(value), maskKey, col);
+}
+function tokenize(value, col, maskKey) {
+  if (value === null || value === void 0) return value;
+  return `tok_${hmacToken(String(value), maskKey, col)}`;
+}
+function drop(_value, _col, _maskKey) {
+  return null;
+}
+function nullify(_value, _col, _maskKey) {
+  return null;
+}
+var _esmReq = createRequire(import.meta.url);
+var _nlpInstance = null;
+var _nlpIts = null;
+function getNlp() {
+  if (_nlpInstance) return { nlp: _nlpInstance, its: _nlpIts };
+  try {
+    const winkNLP = _esmReq("wink-nlp");
+    const model = _esmReq("wink-eng-lite-web-model");
+    const nlp = winkNLP(model, ["ner"]);
+    _nlpInstance = nlp;
+    _nlpIts = nlp.its;
+    return { nlp, its: nlp.its };
+  } catch {
+    return null;
+  }
+}
+function redact_pii(value, _col, _maskKey) {
+  if (value === null || value === void 0) return value;
+  const text = String(value);
+  const ctx = getNlp();
+  if (!ctx) return value;
+  const doc = ctx.nlp.readDoc(text);
+  const replacements = [];
+  doc.entities().each((e) => {
+    replacements.push({ text: e.out(), type: e.out(ctx.its.type) });
+  });
+  let result = text;
+  for (const { text: entityText, type } of replacements) {
+    result = result.replaceAll(entityText, `[REDACTED_${type}]`);
+  }
+  return result;
+}
+var BUILTIN_TRANSFORMS = {
+  mask_email,
+  mask_phone,
+  fake_name,
+  jitter_date,
+  hash,
+  tokenize,
+  drop,
+  nullify,
+  redact_pii
+};
+export {
+  BUILTIN_TRANSFORMS,
+  drop,
+  fake_name,
+  hash,
+  jitter_date,
+  mask_email,
+  mask_phone,
+  nullify,
+  redact_pii,
+  tokenize
+};

package/dist/secrets/index.d.ts

@@ -0,0 +1,41 @@
+import { HazoError } from 'hazo_core';
+
+type SecretsErrorCode = 'HAZO_SECURE_SECRET_NOT_FOUND';
+declare class SecretsError extends HazoError {
+    readonly code: SecretsErrorCode;
+    constructor(code: SecretsErrorCode, message: string);
+}
+interface SecretsProvider {
+    /** Resolve multiple secret names at once. Returns all resolved values.
+     *  Throws SecretsError (HAZO_SECURE_SECRET_NOT_FOUND) for any missing name. */
+    resolve(names: string[]): Promise<Record<string, string>>;
+    /** Resolve a single secret. Throws if absent. */
+    get(name: string): Promise<string>;
+}
+/**
+ * Reads secrets from environment variables.
+ * Variable name = `${prefix}_${NAME.toUpperCase()}` (underscores preserved).
+ * Default prefix: `HAZO_SECRET`
+ */
+declare class EnvSecretsProvider implements SecretsProvider {
+    private readonly prefix;
+    constructor(prefix?: string);
+    get(name: string): Promise<string>;
+    resolve(names: string[]): Promise<Record<string, string>>;
+}
+/** In-memory map. Primary use: tests. */
+declare class StaticSecretsProvider implements SecretsProvider {
+    private readonly map;
+    constructor(secrets: Record<string, string>);
+    get(name: string): Promise<string>;
+    resolve(names: string[]): Promise<Record<string, string>>;
+}
+/** Caller-supplied lookup function. Useful for custom secret backends. */
+declare class LookupSecretsProvider implements SecretsProvider {
+    private readonly lookup;
+    constructor(lookup: (name: string) => string | undefined | Promise<string | undefined>);
+    get(name: string): Promise<string>;
+    resolve(names: string[]): Promise<Record<string, string>>;
+}
+
+export { EnvSecretsProvider, LookupSecretsProvider, SecretsError, type SecretsProvider, StaticSecretsProvider };

package/dist/secrets/index.js

@@ -0,0 +1,84 @@
+// src/secrets/index.ts
+import { HazoError } from "hazo_core";
+var SecretsError = class extends HazoError {
+  constructor(code, message) {
+    super({ code, pkg: "hazo_secure", message, httpStatus: 400, retryable: false });
+    this.name = "SecretsError";
+  }
+};
+var EnvSecretsProvider = class {
+  prefix;
+  constructor(prefix = "HAZO_SECRET") {
+    this.prefix = prefix;
+  }
+  async get(name) {
+    const envKey = `${this.prefix}_${name.toUpperCase()}`;
+    const val = process.env[envKey];
+    if (val === void 0) {
+      throw new SecretsError(
+        "HAZO_SECURE_SECRET_NOT_FOUND",
+        `Secret "${name}" not found (checked env var ${envKey})`
+      );
+    }
+    return val;
+  }
+  async resolve(names) {
+    const out = {};
+    for (const name of names) {
+      out[name] = await this.get(name);
+    }
+    return out;
+  }
+};
+var StaticSecretsProvider = class {
+  map;
+  constructor(secrets) {
+    this.map = new Map(Object.entries(secrets));
+  }
+  async get(name) {
+    const val = this.map.get(name);
+    if (val === void 0) {
+      throw new SecretsError(
+        "HAZO_SECURE_SECRET_NOT_FOUND",
+        `Secret "${name}" not found in static map`
+      );
+    }
+    return val;
+  }
+  async resolve(names) {
+    const out = {};
+    for (const name of names) {
+      out[name] = await this.get(name);
+    }
+    return out;
+  }
+};
+var LookupSecretsProvider = class {
+  lookup;
+  constructor(lookup) {
+    this.lookup = lookup;
+  }
+  async get(name) {
+    const val = await this.lookup(name);
+    if (val === void 0) {
+      throw new SecretsError(
+        "HAZO_SECURE_SECRET_NOT_FOUND",
+        `Secret "${name}" not found via lookup`
+      );
+    }
+    return val;
+  }
+  async resolve(names) {
+    const out = {};
+    for (const name of names) {
+      out[name] = await this.get(name);
+    }
+    return out;
+  }
+};
+export {
+  EnvSecretsProvider,
+  LookupSecretsProvider,
+  SecretsError,
+  StaticSecretsProvider
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_secure",
-  "version": "1.1.0",
+  "version": "1.4.0",
   "description": "Security & compliance primitives — SSRF-safe fetch, rate limiting, field-level encryption, GDPR orchestration, CSRF. Five subpath modules, pick the ones you need.",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,6 +36,16 @@
       "types": "./dist/csrf/index.d.ts",
       "import": "./dist/csrf/index.js",
       "default": "./dist/csrf/index.js"
+    },
+    "./mask": {
+      "types": "./dist/mask/index.d.ts",
+      "import": "./dist/mask/index.js",
+      "default": "./dist/mask/index.js"
+    },
+    "./secrets": {
+      "types": "./dist/secrets/index.d.ts",
+      "import": "./dist/secrets/index.js",
+      "default": "./dist/secrets/index.js"
     }
   },
   "files": [
@@ -53,23 +63,25 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "lint": "tsc --noEmit",
-    "test": "jest",
-    "test:watch": "jest --watch",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
+    "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch",
     "dev:test-app": "npm run build && cd test-app && npm run dev",
     "build:test-app": "npm run build && cd test-app && npm run build",
     "install:test-app": "cd test-app && npm install",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "undici": "^7.3.0"
+    "undici": "^7.3.0",
+    "wink-nlp": "^2.3.1",
+    "wink-eng-lite-web-model": "^1.7.0"
   },
   "peerDependencies": {
-    "hazo_core": "^1.0.0",
-    "hazo_logs": "^2.0.0",
-    "hazo_connect": "^3.0.0",
-    "hazo_jobs": "^0.12.0",
-    "hazo_files": "^3.0.0",
-    "hazo_ui": "^3.1.0"
+    "hazo_core": "^1.2.1",
+    "hazo_logs": "^2.1.1",
+    "hazo_connect": "^3.9.2",
+    "hazo_jobs": "^0.15.0",
+    "hazo_files": "^3.1.1",
+    "hazo_ui": "^6.1.0"
   },
   "peerDependenciesMeta": {
     "hazo_logs": {
@@ -91,17 +103,19 @@
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/node": "^22.10.0",
-    "hazo_core": "^1.0.0",
-    "hazo_logs": "^2.0.1",
-    "hazo_connect": "^3.0.0",
-    "hazo_jobs": "^0.12.0",
-    "hazo_files": "^3.0.0",
-    "hazo_ui": "^3.1.0",
+    "hazo_core": "^1.2.1",
+    "hazo_logs": "^2.1.1",
+    "hazo_connect": "^3.9.2",
+    "hazo_jobs": "^0.15.0",
+    "hazo_files": "^3.1.1",
+    "hazo_ui": "^6.1.0",
     "jest": "^30.2.0",
     "ts-jest": "^29.4.5",
     "tsup": "^8.5.1",
     "typescript": "^5.7.2",
-    "zod": "^3.23.8"
+    "wink-nlp": "^2.3.1",
+    "wink-eng-lite-web-model": "^1.7.0",
+    "zod": "^4.1.12"
   },
   "author": "Pubs Abayasiri",
   "license": "MIT"