@agimon-ai/po-vault 0.0.0-alpha.61

package/dist/vaultRules-CUudYo7G.cjs

@@ -0,0 +1,202 @@
+//#region src/constants/vault.ts
+const PO_VAULT_SERVICE = "po/vault";
+/** The OS keyring service the data-encryption key is stored under, one account per vault id. */
+const VAULT_KEYRING_SERVICE = "ai.agimon.po-vault";
+/** The keyring account prefix; the account is `dek:<vault id in hex>`. */
+const VAULT_KEYRING_ACCOUNT_PREFIX = "dek:";
+/** The po-db table prefix the vault owns. */
+const VAULT_DB_PREFIX = "vault";
+/** The folder under the Po home that holds `key.bin` on hosts with no keyring. */
+const VAULT_DIRECTORY = "vault";
+const VAULT_KEY_FILE = "key.bin";
+const VAULT_CHECK_PLAINTEXT = "po-vault-v1";
+const VAULT_CHECK_AAD = "po-vault:check";
+const VAULT_META_ID = "vault_id";
+const VAULT_META_CHECK = "dek_check";
+/** The lease that serializes first-time key creation across processes. */
+const VAULT_INIT_LEASE = "vault:init";
+const VAULT_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/u;
+const VAULT_LEASE_TTL_MS = 3e4;
+const VAULT_LEASE_RENEW_MS = 1e4;
+const VAULT_LEASE_WAIT_MS = 35e3;
+const VAULT_KEY_LOST_NOTICE = "Vault key was lost. Saved sign-ins were cleared; sign in again.";
+//#endregion
+//#region src/services/vaultRules/index.ts
+const MESSAGES = {
+	unavailable: "The vault is unavailable.",
+	invalid: "The vault request is invalid.",
+	conflict: "The vault entry changed."
+};
+/**
+* Every vault failure. The message is fixed per code, so no key, value or upstream cause can
+* reach a log or a response through it. Consumers match on `code`.
+*/
+var VaultError = class extends Error {
+	code;
+	constructor(code) {
+		super(MESSAGES[code]);
+		this.name = "VaultError";
+		this.code = code;
+	}
+};
+/** Wraps any non-vault failure, typically sqlite, as `unavailable`, dropping its message. */
+function asVaultError(error) {
+	return error instanceof VaultError ? error : new VaultError("unavailable");
+}
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+function assertEntryName(namespace, key) {
+	if (typeof namespace !== "string" || !VAULT_NAMESPACE_PATTERN.test(namespace)) throw new VaultError("invalid");
+	if (typeof key !== "string" || key.length === 0 || key.length > 512 || CONTROL_CHARACTERS.test(key)) throw new VaultError("invalid");
+}
+function assertRevision(revision) {
+	if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 1) throw new VaultError("invalid");
+}
+function isPlainObject(value) {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function assertJsonValue(value, seen) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new VaultError("invalid");
+		return;
+	}
+	if (typeof value !== "object" || seen.has(value)) throw new VaultError("invalid");
+	seen.add(value);
+	if (Array.isArray(value)) for (const item of value) assertJsonValue(item, seen);
+	else {
+		if (!isPlainObject(value)) throw new VaultError("invalid");
+		for (const item of Object.values(value)) assertJsonValue(item, seen);
+	}
+	seen.delete(value);
+}
+/** The stored plaintext of a value: JSON, at most 64 KiB of UTF-8. */
+function serializeValue(value) {
+	assertJsonValue(value, /* @__PURE__ */ new Set());
+	const text = JSON.stringify(value);
+	if (new TextEncoder().encode(text).length > 65536) throw new VaultError("invalid");
+	return text;
+}
+//#endregion
+Object.defineProperty(exports, "PO_VAULT_SERVICE", {
+	enumerable: true,
+	get: function() {
+		return PO_VAULT_SERVICE;
+	}
+});
+Object.defineProperty(exports, "VAULT_CHECK_AAD", {
+	enumerable: true,
+	get: function() {
+		return VAULT_CHECK_AAD;
+	}
+});
+Object.defineProperty(exports, "VAULT_CHECK_PLAINTEXT", {
+	enumerable: true,
+	get: function() {
+		return VAULT_CHECK_PLAINTEXT;
+	}
+});
+Object.defineProperty(exports, "VAULT_DB_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return VAULT_DB_PREFIX;
+	}
+});
+Object.defineProperty(exports, "VAULT_DIRECTORY", {
+	enumerable: true,
+	get: function() {
+		return VAULT_DIRECTORY;
+	}
+});
+Object.defineProperty(exports, "VAULT_INIT_LEASE", {
+	enumerable: true,
+	get: function() {
+		return VAULT_INIT_LEASE;
+	}
+});
+Object.defineProperty(exports, "VAULT_KEYRING_ACCOUNT_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return VAULT_KEYRING_ACCOUNT_PREFIX;
+	}
+});
+Object.defineProperty(exports, "VAULT_KEYRING_SERVICE", {
+	enumerable: true,
+	get: function() {
+		return VAULT_KEYRING_SERVICE;
+	}
+});
+Object.defineProperty(exports, "VAULT_KEY_FILE", {
+	enumerable: true,
+	get: function() {
+		return VAULT_KEY_FILE;
+	}
+});
+Object.defineProperty(exports, "VAULT_KEY_LOST_NOTICE", {
+	enumerable: true,
+	get: function() {
+		return VAULT_KEY_LOST_NOTICE;
+	}
+});
+Object.defineProperty(exports, "VAULT_LEASE_RENEW_MS", {
+	enumerable: true,
+	get: function() {
+		return VAULT_LEASE_RENEW_MS;
+	}
+});
+Object.defineProperty(exports, "VAULT_LEASE_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return VAULT_LEASE_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "VAULT_LEASE_WAIT_MS", {
+	enumerable: true,
+	get: function() {
+		return VAULT_LEASE_WAIT_MS;
+	}
+});
+Object.defineProperty(exports, "VAULT_META_CHECK", {
+	enumerable: true,
+	get: function() {
+		return VAULT_META_CHECK;
+	}
+});
+Object.defineProperty(exports, "VAULT_META_ID", {
+	enumerable: true,
+	get: function() {
+		return VAULT_META_ID;
+	}
+});
+Object.defineProperty(exports, "VaultError", {
+	enumerable: true,
+	get: function() {
+		return VaultError;
+	}
+});
+Object.defineProperty(exports, "asVaultError", {
+	enumerable: true,
+	get: function() {
+		return asVaultError;
+	}
+});
+Object.defineProperty(exports, "assertEntryName", {
+	enumerable: true,
+	get: function() {
+		return assertEntryName;
+	}
+});
+Object.defineProperty(exports, "assertRevision", {
+	enumerable: true,
+	get: function() {
+		return assertRevision;
+	}
+});
+Object.defineProperty(exports, "serializeValue", {
+	enumerable: true,
+	get: function() {
+		return serializeValue;
+	}
+});
+
+//# sourceMappingURL=vaultRules-CUudYo7G.cjs.map

package/dist/vaultRules-CUudYo7G.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultRules-CUudYo7G.cjs","names":[],"sources":["../src/constants/vault.ts","../src/services/vaultRules/index.ts"],"sourcesContent":["export const PO_VAULT_SERVICE = 'po/vault';\n/** The OS keyring service the data-encryption key is stored under, one account per vault id. */\nexport const VAULT_KEYRING_SERVICE = 'ai.agimon.po-vault';\n/** The keyring account prefix; the account is `dek:<vault id in hex>`. */\nexport const VAULT_KEYRING_ACCOUNT_PREFIX = 'dek:';\n/** The po-db table prefix the vault owns. */\nexport const VAULT_DB_PREFIX = 'vault';\n/** The folder under the Po home that holds `key.bin` on hosts with no keyring. */\nexport const VAULT_DIRECTORY = 'vault';\nexport const VAULT_KEY_FILE = 'key.bin';\nexport const VAULT_DIRECTORY_MODE = 0o700;\nexport const VAULT_KEY_FILE_MODE = 0o600;\n\nexport const VAULT_KEY_BYTES = 32;\nexport const VAULT_IV_BYTES = 12;\nexport const VAULT_TAG_BYTES = 16;\nexport const VAULT_ID_BYTES = 16;\nexport const VAULT_CHECK_PLAINTEXT = 'po-vault-v1';\nexport const VAULT_CHECK_AAD = 'po-vault:check';\nexport const VAULT_META_ID = 'vault_id';\nexport const VAULT_META_CHECK = 'dek_check';\n/** The lease that serializes first-time key creation across processes. */\nexport const VAULT_INIT_LEASE = 'vault:init';\n\nexport const VAULT_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/u;\nexport const VAULT_KEY_MAX_LENGTH = 512;\n/** The serialized value, in UTF-8 bytes. */\nexport const VAULT_VALUE_MAX_BYTES = 64 * 1024;\n\nexport const VAULT_LEASE_TTL_MS = 30_000;\nexport const VAULT_LEASE_RENEW_MS = 10_000;\nexport const VAULT_LEASE_WAIT_MS = 35_000;\nexport const VAULT_LEASE_POLL_MS = 50;\nexport const VAULT_LEASE_JITTER_MS = 50;\n\nexport const VAULT_KEY_LOST_NOTICE = 'Vault key was lost. Saved sign-ins were cleared; sign in again.';\n","import { VAULT_KEY_MAX_LENGTH, VAULT_NAMESPACE_PATTERN, VAULT_VALUE_MAX_BYTES } from '../../constants/vault';\nimport type { VaultErrorCode, VaultValue } from '../vault/type';\n\nconst MESSAGES: Readonly<Record<VaultErrorCode, string>> = {\n  unavailable: 'The vault is unavailable.',\n  invalid: 'The vault request is invalid.',\n  conflict: 'The vault entry changed.',\n};\n\n/**\n * Every vault failure. The message is fixed per code, so no key, value or upstream cause can\n * reach a log or a response through it. Consumers match on `code`.\n */\nexport class VaultError extends Error {\n  readonly code: VaultErrorCode;\n\n  constructor(code: VaultErrorCode) {\n    super(MESSAGES[code]);\n    this.name = 'VaultError';\n    this.code = code;\n  }\n}\n\n/** Wraps any non-vault failure, typically sqlite, as `unavailable`, dropping its message. */\nexport function asVaultError(error: unknown): VaultError {\n  return error instanceof VaultError ? error : new VaultError('unavailable');\n}\n\n// oxlint-disable-next-line no-control-regex -- the rule is exactly \"no control characters\"\nconst CONTROL_CHARACTERS = /[\\u0000-\\u001f\\u007f]/u;\n\nexport function assertEntryName(namespace: unknown, key: unknown): void {\n  if (typeof namespace !== 'string' || !VAULT_NAMESPACE_PATTERN.test(namespace)) throw new VaultError('invalid');\n  if (typeof key !== 'string' || key.length === 0 || key.length > VAULT_KEY_MAX_LENGTH || CONTROL_CHARACTERS.test(key))\n    throw new VaultError('invalid');\n}\n\nexport function assertRevision(revision: unknown): void {\n  if (typeof revision !== 'number' || !Number.isSafeInteger(revision) || revision < 1) throw new VaultError('invalid');\n}\n\nfunction isPlainObject(value: object): boolean {\n  const prototype = Object.getPrototypeOf(value) as unknown;\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction assertJsonValue(value: unknown, seen: Set<object>): void {\n  if (value === null || typeof value === 'string' || typeof value === 'boolean') return;\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new VaultError('invalid');\n    return;\n  }\n  if (typeof value !== 'object' || seen.has(value)) throw new VaultError('invalid');\n  seen.add(value);\n  if (Array.isArray(value)) {\n    for (const item of value) assertJsonValue(item, seen);\n  } else {\n    if (!isPlainObject(value)) throw new VaultError('invalid');\n    for (const item of Object.values(value)) assertJsonValue(item, seen);\n  }\n  seen.delete(value);\n}\n\n/** The stored plaintext of a value: JSON, at most 64 KiB of UTF-8. */\nexport function serializeValue(value: VaultValue): string {\n  assertJsonValue(value, new Set());\n  const text = JSON.stringify(value);\n  if (new TextEncoder().encode(text).length > VAULT_VALUE_MAX_BYTES) throw new VaultError('invalid');\n  return text;\n}\n"],"mappings":";AAAA,MAAa,mBAAmB;;AAEhC,MAAa,wBAAwB;;AAErC,MAAa,+BAA+B;;AAE5C,MAAa,kBAAkB;;AAE/B,MAAa,kBAAkB;AAC/B,MAAa,iBAAiB;AAQ9B,MAAa,wBAAwB;AACrC,MAAa,kBAAkB;AAC/B,MAAa,gBAAgB;AAC7B,MAAa,mBAAmB;;AAEhC,MAAa,mBAAmB;AAEhC,MAAa,0BAA0B;AAKvC,MAAa,qBAAqB;AAClC,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AAInC,MAAa,wBAAwB;;;AChCrC,MAAM,WAAqD;CACzD,aAAa;CACb,SAAS;CACT,UAAU;AACZ;;;;;AAMA,IAAa,aAAb,cAAgC,MAAM;CACpC;CAEA,YAAY,MAAsB;EAChC,MAAM,SAAS,KAAK;EACpB,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;AAGA,SAAgB,aAAa,OAA4B;CACvD,OAAO,iBAAiB,aAAa,QAAQ,IAAI,WAAW,aAAa;AAC3E;AAGA,MAAM,qBAAqB;AAE3B,SAAgB,gBAAgB,WAAoB,KAAoB;CACtE,IAAI,OAAO,cAAc,YAAY,CAAC,wBAAwB,KAAK,SAAS,GAAG,MAAM,IAAI,WAAW,SAAS;CAC7G,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,KAAK,IAAI,SAAA,OAAiC,mBAAmB,KAAK,GAAG,GACjH,MAAM,IAAI,WAAW,SAAS;AAClC;AAEA,SAAgB,eAAe,UAAyB;CACtD,IAAI,OAAO,aAAa,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,SAAS;AACrH;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,OAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,gBAAgB,OAAgB,MAAyB;CAChE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW;CAC/E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,MAAM,IAAI,WAAW,SAAS;EAC3D;CACF;CACA,IAAI,OAAO,UAAU,YAAY,KAAK,IAAI,KAAK,GAAG,MAAM,IAAI,WAAW,SAAS;CAChF,KAAK,IAAI,KAAK;CACd,IAAI,MAAM,QAAQ,KAAK,GACrB,KAAK,MAAM,QAAQ,OAAO,gBAAgB,MAAM,IAAI;MAC/C;EACL,IAAI,CAAC,cAAc,KAAK,GAAG,MAAM,IAAI,WAAW,SAAS;EACzD,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,GAAG,gBAAgB,MAAM,IAAI;CACrE;CACA,KAAK,OAAO,KAAK;AACnB;;AAGA,SAAgB,eAAe,OAA2B;CACxD,gBAAgB,uBAAO,IAAI,IAAI,CAAC;CAChC,MAAM,OAAO,KAAK,UAAU,KAAK;CACjC,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAA,OAAgC,MAAM,IAAI,WAAW,SAAS;CACjG,OAAO;AACT"}

package/llms.txt

@@ -0,0 +1,7 @@
+# @agimon-ai/po-vault
+
+The one place Po keeps secrets: encrypted entries in the shared Po database, bound as the global `po/vault` service.
+
+## Resources
+
+- [Package README](./README.md): how secrets are stored, the key and its fallback file, revisions, the cross-process lock, and the memory vault for tests.

package/package.json

@@ -0,0 +1,113 @@
+{
+  "name": "@agimon-ai/po-vault",
+  "version": "0.0.0-alpha.61",
+  "description": "The one place Po keeps secrets: encrypted entries in the shared Po database",
+  "keywords": [
+    "ai",
+    "coding-agent",
+    "credentials",
+    "developer-tools",
+    "po",
+    "secrets",
+    "typescript",
+    "vault"
+  ],
+  "homepage": "https://agimon.ai",
+  "bugs": {
+    "url": "https://github.com/AgiFlow/po/issues"
+  },
+  "license": "BUSL-1.1",
+  "author": "Vuong Ngo",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AgiFlow/po.git",
+    "directory": "packages/foundations/po-vault"
+  },
+  "files": [
+    "dist",
+    "llms.txt",
+    "README.md",
+    "LICENSE",
+    "package.json"
+  ],
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "jsnext:main": "./dist/index.mjs",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    },
+    "./apiContracts": {
+      "types": "./dist/apiContracts.d.mts",
+      "import": "./dist/apiContracts.mjs",
+      "require": "./dist/apiContracts.cjs"
+    },
+    "./extensions/server": {
+      "types": "./dist/extensions/server.d.mts",
+      "import": "./dist/extensions/server.mjs",
+      "require": "./dist/extensions/server.cjs"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.mts",
+      "import": "./dist/testing.mjs",
+      "require": "./dist/testing.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@agimon-ai/po-core": "0.0.0-alpha.61",
+    "@agimon-ai/po-db": "0.0.0-alpha.61",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@napi-rs/keyring": "2.1.1"
+  },
+  "devDependencies": {
+    "@agimon-ai/po-build": "0.0.0-alpha.61",
+    "@agimon-ai/vibe-lint-plugin-po-extension": "0.0.0-alpha.61",
+    "@types/node": "26.6.5",
+    "@vitest/coverage-v8": "5.0.4",
+    "tsdown": "0.23.1",
+    "typescript": "7.0.2",
+    "vitest": "5.0.4"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "poServer": {
+    "entry": "./generated/server.ts",
+    "dist": "./dist/extensions/server.mjs",
+    "scopes": [
+      "global",
+      "workspace",
+      "session"
+    ],
+    "contracts": {
+      "entry": "./src/exports/apiContracts.ts",
+      "dist": "./dist/apiContracts.mjs"
+    },
+    "injects": {
+      "global": [
+        "po/db"
+      ],
+      "workspace": [
+        "po/db"
+      ],
+      "session": [
+        "po/db"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest --run",
+    "typecheck": "tsrs --noEmit",
+    "lint": "oxlint . && oxfmt . --check",
+    "fixcode": "oxlint . --fix && oxfmt ."
+  }
+}