var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
// ---------------------------------------------------------------------------
//  VaultBackedSecretStore
// ---------------------------------------------------------------------------
/**
 * Vault-backed implementation of {@link SecretStore}.
 *
 * Secrets are encrypted with the vault's content encryption key (AES-256-GCM
 * via `dir` algorithm) before being persisted to the backing
 * {@link KeyValueStore}. The vault must be unlocked for {@link put} and
 * {@link get} operations; {@link delete} does not require the vault to be
 * unlocked since it only removes the encrypted envelope.
 */
export class VaultBackedSecretStore {
    constructor({ vault, store }) {
        this._vault = vault;
        this._store = store;
    }
    put(key, value, options) {
        return __awaiter(this, void 0, void 0, function* () {
            // vault.encryptData() throws if the vault is locked.
            const jwe = yield this._vault.encryptData({ plaintext: value });
            const envelope = { jwe };
            if ((options === null || options === void 0 ? void 0 : options.expiresAt) !== undefined) {
                envelope.expiresAt = options.expiresAt;
            }
            yield this._store.set(key, JSON.stringify(envelope));
        });
    }
    get(key) {
        return __awaiter(this, void 0, void 0, function* () {
            const raw = yield this._store.get(key);
            if (raw === undefined) {
                return undefined;
            }
            const envelope = JSON.parse(raw);
            // Purge expired secrets.
            if (envelope.expiresAt !== undefined && new Date(envelope.expiresAt).getTime() <= Date.now()) {
                yield this._store.delete(key);
                return undefined;
            }
            // vault.decryptData() throws if the vault is locked.
            return this._vault.decryptData({ jwe: envelope.jwe });
        });
    }
    delete(key) {
        return __awaiter(this, void 0, void 0, function* () {
            const existing = yield this._store.get(key);
            if (existing === undefined) {
                return false;
            }
            yield this._store.delete(key);
            return true;
        });
    }
}
// ---------------------------------------------------------------------------
//  InMemorySecretStore
// ---------------------------------------------------------------------------
/**
 * In-memory implementation of {@link SecretStore} for testing.
 *
 * Secrets are stored as plain `Uint8Array` values in a `Map` — no encryption,
 * no persistence. This is suitable only for unit tests.
 */
export class InMemorySecretStore {
    constructor() {
        this._store = new Map();
    }
    put(key, value, options) {
        return __awaiter(this, void 0, void 0, function* () {
            this._store.set(key, {
                value: new Uint8Array(value),
                expiresAt: options === null || options === void 0 ? void 0 : options.expiresAt,
            });
        });
    }
    get(key) {
        return __awaiter(this, void 0, void 0, function* () {
            const entry = this._store.get(key);
            if (entry === undefined) {
                return undefined;
            }
            // Purge expired secrets.
            if (entry.expiresAt !== undefined && new Date(entry.expiresAt).getTime() <= Date.now()) {
                this._store.delete(key);
                return undefined;
            }
            return new Uint8Array(entry.value);
        });
    }
    delete(key) {
        return __awaiter(this, void 0, void 0, function* () {
            return this._store.delete(key);
        });
    }
}
//# sourceMappingURL=secret-store.js.map