@caupulican/pi-adaptative 0.81.40 → 0.81.41

package/dist/core/secrets/secret-vault-format.d.ts

@@ -0,0 +1,112 @@
+export declare const VAULT_MARKER = "pi-secret-vault-v1";
+export declare const DEFAULT_SCRYPT_N = 32768;
+export declare const MAX_VAULT_FILE_BYTES: number;
+export declare const MAX_PROFILES = 64;
+export declare const MAX_VARIABLES_PER_PROFILE = 64;
+export declare const MAX_BINDINGS_PER_PROFILE = 16;
+export declare const SECRET_PROFILE_ID_MAX_CHARS = 64;
+export declare const SECRET_DESCRIPTION_MAX_CHARS = 240;
+export declare const SECRET_PROFILE_ID_PATTERN = "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?$";
+export { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from "./secret-dotenv.ts";
+export declare const SECRET_PRINTABLE_METADATA_PATTERN = "^[^\\u0000-\\u001f\\u007f-\\u009f]+$";
+export declare const MANAGED_ENV_HEADER_PREFIX = "# pi-secret-store:v1 profile=";
+export type SecretVaultErrorCode = "already_initialized" | "ambiguous_binding" | "binding_missing" | "destination_conflict" | "destination_invalid" | "invalid_description" | "invalid_dotenv" | "invalid_passphrase" | "invalid_profile" | "invalid_variable" | "not_initialized" | "not_unlocked" | "profile_limit" | "profile_missing" | "symlink_refused" | "unlock_failed" | "value_too_large" | "variable_limit" | "vault_corrupt" | "vault_too_large";
+export declare class SecretVaultError extends Error {
+    readonly code: SecretVaultErrorCode;
+    constructor(code: SecretVaultErrorCode, message: string);
+}
+export interface SecretVariableValue {
+    name: string;
+    value: string;
+}
+export interface SecretProfileSummary {
+    profile: string;
+    description?: string;
+    variableNames: string[];
+    bindings: SecretBindingSummary[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SecretBindingSummary {
+    workspace: string;
+    envFile: string;
+    updatedAt: string;
+}
+export interface SecretBindingResolution extends SecretBindingSummary {
+    profile: string;
+    destination: string;
+    variableNames: string[];
+}
+export type SecretEnvDestinationState = "missing" | "managed-profile" | "managed-other" | "unmanaged";
+export interface SecretMaterializationResult {
+    profile: string;
+    variableNames: string[];
+    previousState: SecretEnvDestinationState;
+}
+export interface SecretRemovalResult {
+    profile: string;
+    removedProfile: boolean;
+    removedVariableNames: string[];
+    managedMaterializationRemoved: boolean;
+    boundMaterializationsRemoved: number;
+}
+export interface SecretVaultOptions {
+    agentDir: string;
+    /** Test-only cost override. Production callers should retain the default. */
+    scryptN?: number;
+    now?: () => Date;
+    /** Reset credential-bearing child process state after activation, mutation, or lock. */
+    onEnvironmentChanged?: () => void;
+}
+export interface VaultKdf {
+    algorithm: "scrypt";
+    salt: string;
+    N: number;
+    r: number;
+    p: number;
+    keyLength: number;
+}
+export interface VaultCiphertext {
+    iv: string;
+    tag: string;
+    ciphertext: string;
+}
+export interface VaultEnvelope {
+    version: 1;
+    kdf: VaultKdf;
+    payload: VaultCiphertext;
+}
+export interface SecretProfileRecord {
+    profile: string;
+    description?: string;
+    createdAt: string;
+    updatedAt: string;
+    dotenv: string;
+    bindings: SecretBindingSummary[];
+}
+export interface VaultPayload {
+    marker: typeof VAULT_MARKER;
+    profiles: SecretProfileRecord[];
+}
+export declare function validateScryptN(value: number): number;
+export declare function createVaultKdf(scryptN: number): VaultKdf;
+export declare function parseEnvelope(text: string): VaultEnvelope;
+export declare function validateProfileId(profile: string): string;
+export declare function validateDescription(description: string | undefined): string | undefined;
+export declare function validateBindingWorkspace(workspace: string): string;
+export declare function validateBindingEnvFile(envFile: string): string;
+export declare function validateVariableName(name: string): string;
+export declare function validateSecretValue(value: string): string;
+export declare function validateDotenvProfileDocument(document: string): {
+    document: string;
+    variables: SecretVariableValue[];
+};
+export declare function scrubPayload(payload: VaultPayload): void;
+export declare function assertPassphrase(passphrase: string, creating: boolean): void;
+export declare function sameKdf(left: VaultKdf, right: VaultKdf): boolean;
+export declare function deriveKey(passphrase: string, kdf: VaultKdf): Promise<Buffer>;
+export declare function decryptPayload(ciphertext: VaultCiphertext, key: Buffer): VaultPayload;
+export declare function serializeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): string;
+export declare function profileSummary(profile: SecretProfileRecord): SecretProfileSummary;
+export declare function serializeVariableValues(values: readonly SecretVariableValue[]): string;
+//# sourceMappingURL=secret-vault-format.d.ts.map

package/dist/core/secrets/secret-vault-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-vault-format.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault-format.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAOjD,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAKvC,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AAEpD,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,yBAAyB,KAAuB,CAAC;AAC9D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAG3C,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,yBAAyB,sDAAsF,CAAC;AAC7H,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClG,eAAO,MAAM,iCAAiC,yCAAyC,CAAC;AACxF,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,MAAM,MAAM,oBAAoB,GAC7B,qBAAqB,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,CAAC;AAErB,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAEpC,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAItD;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,iBAAiB,GAAG,eAAe,GAAG,WAAW,CAAC;AAEtG,MAAM,WAAW,2BAA2B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,yBAAyB,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,6BAA6B,EAAE,OAAO,CAAC;IACvC,4BAA4B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wFAAwF;IACxF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACxB,SAAS,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,OAAO,YAAY,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAkBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAcxD;AAkCD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAWzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOvF;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsB9D;AAoBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAczD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAOA;AA8DD,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAExD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAa5E;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAShE;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAalF;AAgCD,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CA6BrF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAO3F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,oBAAoB,CAUjF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,CAEtF","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\";\nimport { isAbsolute, normalize, sep } from \"node:path\";\nimport {\n\tformatDotenvVariables,\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tSecretDotenvError,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst VAULT_VERSION = 1;\nexport const VAULT_MARKER = \"pi-secret-vault-v1\";\nconst VAULT_AAD = Buffer.from(\"pi-secret-vault:v1\", \"utf8\");\nconst AES_ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 16;\nexport const DEFAULT_SCRYPT_N = 32_768;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst MIN_SCRYPT_N = 1_024;\nconst MAX_SCRYPT_N = 65_536;\nexport const MAX_VAULT_FILE_BYTES = 4 * 1024 * 1024;\nconst MAX_VAULT_PAYLOAD_BYTES = 2 * 1024 * 1024;\nexport const MAX_PROFILES = 64;\nexport const MAX_VARIABLES_PER_PROFILE = MAX_DOTENV_VARIABLES;\nexport const MAX_BINDINGS_PER_PROFILE = 16;\nconst MAX_PASSPHRASE_CHARS = 4_096;\nconst MIN_NEW_PASSPHRASE_CHARS = 12;\nexport const SECRET_PROFILE_ID_MAX_CHARS = 64;\nexport const SECRET_DESCRIPTION_MAX_CHARS = 240;\nexport const SECRET_PROFILE_ID_PATTERN = `^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,${SECRET_PROFILE_ID_MAX_CHARS - 2}}[A-Za-z0-9])?$`;\nexport { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from \"./secret-dotenv.ts\";\nexport const SECRET_PRINTABLE_METADATA_PATTERN = \"^[^\\\\u0000-\\\\u001f\\\\u007f-\\\\u009f]+$\";\nexport const MANAGED_ENV_HEADER_PREFIX = \"# pi-secret-store:v1 profile=\";\nconst PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);\nconst PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);\nconst WINDOWS_RESERVED_NAME_RE = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/i;\n\nexport type SecretVaultErrorCode =\n\t| \"already_initialized\"\n\t| \"ambiguous_binding\"\n\t| \"binding_missing\"\n\t| \"destination_conflict\"\n\t| \"destination_invalid\"\n\t| \"invalid_description\"\n\t| \"invalid_dotenv\"\n\t| \"invalid_passphrase\"\n\t| \"invalid_profile\"\n\t| \"invalid_variable\"\n\t| \"not_initialized\"\n\t| \"not_unlocked\"\n\t| \"profile_limit\"\n\t| \"profile_missing\"\n\t| \"symlink_refused\"\n\t| \"unlock_failed\"\n\t| \"value_too_large\"\n\t| \"variable_limit\"\n\t| \"vault_corrupt\"\n\t| \"vault_too_large\";\n\nexport class SecretVaultError extends Error {\n\treadonly code: SecretVaultErrorCode;\n\n\tconstructor(code: SecretVaultErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"SecretVaultError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface SecretVariableValue {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface SecretProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tbindings: SecretBindingSummary[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingSummary {\n\tworkspace: string;\n\tenvFile: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingResolution extends SecretBindingSummary {\n\tprofile: string;\n\tdestination: string;\n\tvariableNames: string[];\n}\n\nexport type SecretEnvDestinationState = \"missing\" | \"managed-profile\" | \"managed-other\" | \"unmanaged\";\n\nexport interface SecretMaterializationResult {\n\tprofile: string;\n\tvariableNames: string[];\n\tpreviousState: SecretEnvDestinationState;\n}\n\nexport interface SecretRemovalResult {\n\tprofile: string;\n\tremovedProfile: boolean;\n\tremovedVariableNames: string[];\n\tmanagedMaterializationRemoved: boolean;\n\tboundMaterializationsRemoved: number;\n}\n\nexport interface SecretVaultOptions {\n\tagentDir: string;\n\t/** Test-only cost override. Production callers should retain the default. */\n\tscryptN?: number;\n\tnow?: () => Date;\n\t/** Reset credential-bearing child process state after activation, mutation, or lock. */\n\tonEnvironmentChanged?: () => void;\n}\n\nexport interface VaultKdf {\n\talgorithm: \"scrypt\";\n\tsalt: string;\n\tN: number;\n\tr: number;\n\tp: number;\n\tkeyLength: number;\n}\n\nexport interface VaultCiphertext {\n\tiv: string;\n\ttag: string;\n\tciphertext: string;\n}\n\nexport interface VaultEnvelope {\n\tversion: 1;\n\tkdf: VaultKdf;\n\tpayload: VaultCiphertext;\n}\n\nexport interface SecretProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tdotenv: string;\n\tbindings: SecretBindingSummary[];\n}\n\nexport interface VaultPayload {\n\tmarker: typeof VAULT_MARKER;\n\tprofiles: SecretProfileRecord[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction decodeCanonicalBase64(value: unknown, field: string, expectedBytes?: number): Buffer {\n\tif (typeof value !== \"string\" || value.length === 0 || value.length > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif (decoded.toString(\"base64\") !== value || (expectedBytes !== undefined && decoded.byteLength !== expectedBytes)) {\n\t\tdecoded.fill(0);\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\treturn decoded;\n}\n\nexport function validateScryptN(value: number): number {\n\tif (!Number.isInteger(value) || value < MIN_SCRYPT_N || value > MAX_SCRYPT_N || (value & (value - 1)) !== 0) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are invalid.\");\n\t}\n\treturn value;\n}\n\nexport function createVaultKdf(scryptN: number): VaultKdf {\n\tconst salt = randomBytes(SALT_LENGTH);\n\ttry {\n\t\treturn {\n\t\t\talgorithm: \"scrypt\",\n\t\t\tsalt: salt.toString(\"base64\"),\n\t\t\tN: validateScryptN(scryptN),\n\t\t\tr: SCRYPT_R,\n\t\t\tp: SCRYPT_P,\n\t\t\tkeyLength: KEY_LENGTH,\n\t\t};\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction parseKdf(value: unknown): VaultKdf {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF is missing.\");\n\tif (value.algorithm !== \"scrypt\" || value.r !== SCRYPT_R || value.p !== SCRYPT_P || value.keyLength !== KEY_LENGTH) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are unsupported.\");\n\t}\n\tconst salt = decodeCanonicalBase64(value.salt, \"salt\", SALT_LENGTH);\n\tsalt.fill(0);\n\treturn {\n\t\talgorithm: \"scrypt\",\n\t\tsalt: value.salt as string,\n\t\tN: validateScryptN(value.N as number),\n\t\tr: SCRYPT_R,\n\t\tp: SCRYPT_P,\n\t\tkeyLength: KEY_LENGTH,\n\t};\n}\n\nfunction parseCiphertext(value: unknown): VaultCiphertext {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is missing.\");\n\tconst iv = decodeCanonicalBase64(value.iv, \"IV\", IV_LENGTH);\n\tconst tag = decodeCanonicalBase64(value.tag, \"authentication tag\", AUTH_TAG_LENGTH);\n\tconst ciphertext = decodeCanonicalBase64(value.ciphertext, \"ciphertext\");\n\tiv.fill(0);\n\ttag.fill(0);\n\tciphertext.fill(0);\n\treturn {\n\t\tiv: value.iv as string,\n\t\ttag: value.tag as string,\n\t\tciphertext: value.ciphertext as string,\n\t};\n}\n\nexport function parseEnvelope(text: string): VaultEnvelope {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault data is not valid JSON.\");\n\t}\n\tif (!isRecord(parsed) || parsed.version !== VAULT_VERSION) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault version is unsupported.\");\n\t}\n\treturn { version: VAULT_VERSION, kdf: parseKdf(parsed.kdf), payload: parseCiphertext(parsed.payload) };\n}\n\nexport function validateProfileId(profile: string): string {\n\tif (!PROFILE_ID_RE.test(profile) || WINDOWS_RESERVED_NAME_RE.test(profile)) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Profile names must be portable 1-64 character identifiers using letters, numbers, dot, dash, or underscore.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateDescription(description: string | undefined): string | undefined {\n\tif (description === undefined) return undefined;\n\tconst normalized = description.trim();\n\tif (!normalized || normalized.length > SECRET_DESCRIPTION_MAX_CHARS || !PRINTABLE_METADATA_RE.test(normalized)) {\n\t\tthrow new SecretVaultError(\"invalid_description\", \"Secret profile descriptions must be short printable text.\");\n\t}\n\treturn normalized;\n}\n\nexport function validateBindingWorkspace(workspace: string): string {\n\tif (\n\t\t!isAbsolute(workspace) ||\n\t\tworkspace.length > 4_096 ||\n\t\tworkspace.includes(\"\\0\") ||\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(workspace)\n\t) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential workspace must be an absolute local path.\");\n\t}\n\treturn normalize(workspace);\n}\n\nexport function validateBindingEnvFile(envFile: string): string {\n\tconst trimmed = envFile.trim();\n\tconst normalized = normalize(trimmed);\n\tconst segments = normalized.split(/[\\\\/]+/);\n\tconst fileName = segments.at(-1) ?? \"\";\n\tif (\n\t\t!trimmed ||\n\t\ttrimmed.length > 512 ||\n\t\tisAbsolute(trimmed) ||\n\t\tnormalized === \"..\" ||\n\t\tnormalized.startsWith(`..${sep}`) ||\n\t\tsegments.includes(\"..\") ||\n\t\ttrimmed.includes(\"\\0\") ||\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(trimmed) ||\n\t\t!(fileName === \".env\" || fileName.startsWith(\".env.\") || fileName.endsWith(\".env\"))\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential target must be a relative dotenv path inside the workspace (for example .env or config/dev.env).\",\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction parseBinding(value: unknown): SecretBindingSummary {\n\tif (!isRecord(value) || typeof value.workspace !== \"string\" || typeof value.envFile !== \"string\") {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t}\n\ttry {\n\t\treturn {\n\t\t\tworkspace: validateBindingWorkspace(value.workspace),\n\t\t\tenvFile: validateBindingEnvFile(value.envFile),\n\t\t\tupdatedAt: validateTimestamp(value.updatedAt),\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateVariableName(name: string): string {\n\ttry {\n\t\treturn validateDotenvVariableName(name);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable names must use portable dotenv syntax.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateSecretValue(value: string): string {\n\ttry {\n\t\treturn validateDotenvValue(value);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\terror.message.includes(\"64 KiB\") ? \"value_too_large\" : \"invalid_variable\",\n\t\t\t\terror.message.includes(\"64 KiB\")\n\t\t\t\t\t? \"A secret value exceeds the 64 KiB limit.\"\n\t\t\t\t\t: \"Secret values cannot contain null bytes.\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateDotenvProfileDocument(document: string): {\n\tdocument: string;\n\tvariables: SecretVariableValue[];\n} {\n\ttry {\n\t\treturn parseDotenvDocument(document);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) throw new SecretVaultError(\"invalid_dotenv\", error.message);\n\t\tthrow error;\n\t}\n}\n\nfunction validateTimestamp(value: unknown): string {\n\tif (typeof value !== \"string\" || value.length > 64 || Number.isNaN(Date.parse(value))) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault timestamps are invalid.\");\n\t}\n\treturn value;\n}\n\nfunction parsePayload(value: unknown): VaultPayload {\n\tif (!isRecord(value) || value.marker !== VAULT_MARKER || !Array.isArray(value.profiles)) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t}\n\tif (value.profiles.length > MAX_PROFILES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile count exceeds its bound.\");\n\t}\n\tconst profileNames = new Set<string>();\n\tconst profiles: SecretProfileRecord[] = value.profiles.map((candidate) => {\n\t\tif (!isRecord(candidate) || typeof candidate.dotenv !== \"string\" || !Array.isArray(candidate.bindings)) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile data is invalid.\");\n\t\t}\n\t\tconst profile = validateProfileId(typeof candidate.profile === \"string\" ? candidate.profile : \"\");\n\t\tif (profileNames.has(profile))\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profiles are duplicated.\");\n\t\tprofileNames.add(profile);\n\t\tlet dotenv: string;\n\t\ttry {\n\t\t\tdotenv = validateDotenvProfileDocument(candidate.dotenv).document;\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault dotenv data is invalid.\");\n\t\t}\n\t\tif (candidate.bindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding count exceeds its bound.\");\n\t\t}\n\t\tconst bindingIds = new Set<string>();\n\t\tconst bindings = candidate.bindings.map((binding) => {\n\t\t\tconst parsed = parseBinding(binding);\n\t\t\tconst id = `${parsed.workspace}\\0${parsed.envFile}`;\n\t\t\tif (bindingIds.has(id)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault bindings are duplicated.\");\n\t\t\tbindingIds.add(id);\n\t\t\treturn parsed;\n\t\t});\n\t\treturn {\n\t\t\tprofile,\n\t\t\t...(candidate.description !== undefined\n\t\t\t\t? {\n\t\t\t\t\t\tdescription: validateDescription(\n\t\t\t\t\t\t\ttypeof candidate.description === \"string\" ? candidate.description : \"\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\tcreatedAt: validateTimestamp(candidate.createdAt),\n\t\t\tupdatedAt: validateTimestamp(candidate.updatedAt),\n\t\t\tdotenv,\n\t\t\tbindings: bindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) || left.envFile.localeCompare(right.envFile),\n\t\t\t),\n\t\t};\n\t});\n\treturn { marker: VAULT_MARKER, profiles: profiles.sort((left, right) => left.profile.localeCompare(right.profile)) };\n}\n\nexport function scrubPayload(payload: VaultPayload): void {\n\tfor (const profile of payload.profiles) profile.dotenv = \"\";\n}\n\nexport function assertPassphrase(passphrase: string, creating: boolean): void {\n\tif (\n\t\tpassphrase.length > MAX_PASSPHRASE_CHARS ||\n\t\tpassphrase.includes(\"\\0\") ||\n\t\t(creating ? passphrase.length < MIN_NEW_PASSPHRASE_CHARS : passphrase.length === 0)\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_passphrase\",\n\t\t\tcreating\n\t\t\t\t? `The vault passphrase must contain ${MIN_NEW_PASSPHRASE_CHARS}-${MAX_PASSPHRASE_CHARS} characters.`\n\t\t\t\t: \"The vault passphrase is invalid.\",\n\t\t);\n\t}\n}\n\nexport function sameKdf(left: VaultKdf, right: VaultKdf): boolean {\n\treturn (\n\t\tleft.algorithm === right.algorithm &&\n\t\tleft.salt === right.salt &&\n\t\tleft.N === right.N &&\n\t\tleft.r === right.r &&\n\t\tleft.p === right.p &&\n\t\tleft.keyLength === right.keyLength\n\t);\n}\n\nexport async function deriveKey(passphrase: string, kdf: VaultKdf): Promise<Buffer> {\n\tconst salt = Buffer.from(kdf.salt, \"base64\");\n\tconst maxmem = Math.max(64 * 1024 * 1024, 128 * kdf.N * kdf.r + 16 * 1024 * 1024);\n\ttry {\n\t\treturn await new Promise<Buffer>((resolveKey, reject) => {\n\t\t\tscrypt(passphrase, salt, kdf.keyLength, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem }, (error, key) => {\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolveKey(key);\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction encryptPayload(payload: VaultPayload, key: Buffer): VaultCiphertext {\n\tlet serialized = JSON.stringify(payload);\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_PAYLOAD_BYTES) {\n\t\tserialized = \"\";\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t}\n\tconst plaintext = Buffer.from(serialized, \"utf8\");\n\tserialized = \"\";\n\tconst iv = randomBytes(IV_LENGTH);\n\ttry {\n\t\tconst cipher = createCipheriv(AES_ALGORITHM, key, iv);\n\t\tcipher.setAAD(VAULT_AAD);\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tiv: iv.toString(\"base64\"),\n\t\t\t\ttag: tag.toString(\"base64\"),\n\t\t\t\tciphertext: ciphertext.toString(\"base64\"),\n\t\t\t};\n\t\t} finally {\n\t\t\ttag.fill(0);\n\t\t\tciphertext.fill(0);\n\t\t}\n\t} finally {\n\t\tplaintext.fill(0);\n\t\tiv.fill(0);\n\t}\n}\n\nexport function decryptPayload(ciphertext: VaultCiphertext, key: Buffer): VaultPayload {\n\tconst iv = Buffer.from(ciphertext.iv, \"base64\");\n\tconst tag = Buffer.from(ciphertext.tag, \"base64\");\n\tconst encrypted = Buffer.from(ciphertext.ciphertext, \"base64\");\n\tlet plaintext: Buffer | undefined;\n\ttry {\n\t\tconst decipher = createDecipheriv(AES_ALGORITHM, key, iv);\n\t\tdecipher.setAAD(VAULT_AAD);\n\t\tdecipher.setAuthTag(tag);\n\t\tplaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\t\tif (plaintext.byteLength > MAX_VAULT_PAYLOAD_BYTES) {\n\t\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t\t}\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(plaintext.toString(\"utf8\"));\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t\t}\n\t\treturn parsePayload(parsed);\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) throw error;\n\t\tthrow new SecretVaultError(\"unlock_failed\", \"The vault passphrase is incorrect or the vault is damaged.\");\n\t} finally {\n\t\tiv.fill(0);\n\t\ttag.fill(0);\n\t\tencrypted.fill(0);\n\t\tplaintext?.fill(0);\n\t}\n}\n\nexport function serializeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): string {\n\tconst envelope: VaultEnvelope = { version: VAULT_VERSION, kdf, payload: encryptPayload(payload, key) };\n\tconst serialized = `${JSON.stringify(envelope, null, 2)}\\n`;\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault file exceeds its 4 MiB limit.\");\n\t}\n\treturn serialized;\n}\n\nexport function profileSummary(profile: SecretProfileRecord): SecretProfileSummary {\n\tconst parsed = validateDotenvProfileDocument(profile.dotenv);\n\treturn {\n\t\tprofile: profile.profile,\n\t\t...(profile.description ? { description: profile.description } : {}),\n\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\tcreatedAt: profile.createdAt,\n\t\tupdatedAt: profile.updatedAt,\n\t};\n}\n\nexport function serializeVariableValues(values: readonly SecretVariableValue[]): string {\n\treturn formatDotenvVariables(values);\n}\n"]}

package/dist/core/secrets/secret-vault-format.js

@@ -0,0 +1,397 @@
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import { isAbsolute, normalize, sep } from "node:path";
+import { formatDotenvVariables, MAX_DOTENV_VARIABLES, parseDotenvDocument, SecretDotenvError, validateDotenvValue, validateDotenvVariableName, } from "./secret-dotenv.js";
+const VAULT_VERSION = 1;
+export const VAULT_MARKER = "pi-secret-vault-v1";
+const VAULT_AAD = Buffer.from("pi-secret-vault:v1", "utf8");
+const AES_ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const SALT_LENGTH = 16;
+export const DEFAULT_SCRYPT_N = 32_768;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const MIN_SCRYPT_N = 1_024;
+const MAX_SCRYPT_N = 65_536;
+export const MAX_VAULT_FILE_BYTES = 4 * 1024 * 1024;
+const MAX_VAULT_PAYLOAD_BYTES = 2 * 1024 * 1024;
+export const MAX_PROFILES = 64;
+export const MAX_VARIABLES_PER_PROFILE = MAX_DOTENV_VARIABLES;
+export const MAX_BINDINGS_PER_PROFILE = 16;
+const MAX_PASSPHRASE_CHARS = 4_096;
+const MIN_NEW_PASSPHRASE_CHARS = 12;
+export const SECRET_PROFILE_ID_MAX_CHARS = 64;
+export const SECRET_DESCRIPTION_MAX_CHARS = 240;
+export const SECRET_PROFILE_ID_PATTERN = `^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,${SECRET_PROFILE_ID_MAX_CHARS - 2}}[A-Za-z0-9])?$`;
+export { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from "./secret-dotenv.js";
+export const SECRET_PRINTABLE_METADATA_PATTERN = "^[^\\u0000-\\u001f\\u007f-\\u009f]+$";
+export const MANAGED_ENV_HEADER_PREFIX = "# pi-secret-store:v1 profile=";
+const PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);
+const PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);
+const WINDOWS_RESERVED_NAME_RE = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+export class SecretVaultError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "SecretVaultError";
+        this.code = code;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeCanonicalBase64(value, field, expectedBytes) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_VAULT_FILE_BYTES) {
+        throw new SecretVaultError("vault_corrupt", `Secret vault ${field} is invalid.`);
+    }
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value || (expectedBytes !== undefined && decoded.byteLength !== expectedBytes)) {
+        decoded.fill(0);
+        throw new SecretVaultError("vault_corrupt", `Secret vault ${field} is invalid.`);
+    }
+    return decoded;
+}
+export function validateScryptN(value) {
+    if (!Number.isInteger(value) || value < MIN_SCRYPT_N || value > MAX_SCRYPT_N || (value & (value - 1)) !== 0) {
+        throw new SecretVaultError("vault_corrupt", "Secret vault KDF settings are invalid.");
+    }
+    return value;
+}
+export function createVaultKdf(scryptN) {
+    const salt = randomBytes(SALT_LENGTH);
+    try {
+        return {
+            algorithm: "scrypt",
+            salt: salt.toString("base64"),
+            N: validateScryptN(scryptN),
+            r: SCRYPT_R,
+            p: SCRYPT_P,
+            keyLength: KEY_LENGTH,
+        };
+    }
+    finally {
+        salt.fill(0);
+    }
+}
+function parseKdf(value) {
+    if (!isRecord(value))
+        throw new SecretVaultError("vault_corrupt", "Secret vault KDF is missing.");
+    if (value.algorithm !== "scrypt" || value.r !== SCRYPT_R || value.p !== SCRYPT_P || value.keyLength !== KEY_LENGTH) {
+        throw new SecretVaultError("vault_corrupt", "Secret vault KDF settings are unsupported.");
+    }
+    const salt = decodeCanonicalBase64(value.salt, "salt", SALT_LENGTH);
+    salt.fill(0);
+    return {
+        algorithm: "scrypt",
+        salt: value.salt,
+        N: validateScryptN(value.N),
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+        keyLength: KEY_LENGTH,
+    };
+}
+function parseCiphertext(value) {
+    if (!isRecord(value))
+        throw new SecretVaultError("vault_corrupt", "Secret vault payload is missing.");
+    const iv = decodeCanonicalBase64(value.iv, "IV", IV_LENGTH);
+    const tag = decodeCanonicalBase64(value.tag, "authentication tag", AUTH_TAG_LENGTH);
+    const ciphertext = decodeCanonicalBase64(value.ciphertext, "ciphertext");
+    iv.fill(0);
+    tag.fill(0);
+    ciphertext.fill(0);
+    return {
+        iv: value.iv,
+        tag: value.tag,
+        ciphertext: value.ciphertext,
+    };
+}
+export function parseEnvelope(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new SecretVaultError("vault_corrupt", "Secret vault data is not valid JSON.");
+    }
+    if (!isRecord(parsed) || parsed.version !== VAULT_VERSION) {
+        throw new SecretVaultError("vault_corrupt", "Secret vault version is unsupported.");
+    }
+    return { version: VAULT_VERSION, kdf: parseKdf(parsed.kdf), payload: parseCiphertext(parsed.payload) };
+}
+export function validateProfileId(profile) {
+    if (!PROFILE_ID_RE.test(profile) || WINDOWS_RESERVED_NAME_RE.test(profile)) {
+        throw new SecretVaultError("invalid_profile", "Profile names must be portable 1-64 character identifiers using letters, numbers, dot, dash, or underscore.");
+    }
+    return profile;
+}
+export function validateDescription(description) {
+    if (description === undefined)
+        return undefined;
+    const normalized = description.trim();
+    if (!normalized || normalized.length > SECRET_DESCRIPTION_MAX_CHARS || !PRINTABLE_METADATA_RE.test(normalized)) {
+        throw new SecretVaultError("invalid_description", "Secret profile descriptions must be short printable text.");
+    }
+    return normalized;
+}
+export function validateBindingWorkspace(workspace) {
+    if (!isAbsolute(workspace) ||
+        workspace.length > 4_096 ||
+        workspace.includes("\0") ||
+        /[\u0000-\u001f\u007f-\u009f]/.test(workspace)) {
+        throw new SecretVaultError("destination_invalid", "Credential workspace must be an absolute local path.");
+    }
+    return normalize(workspace);
+}
+export function validateBindingEnvFile(envFile) {
+    const trimmed = envFile.trim();
+    const normalized = normalize(trimmed);
+    const segments = normalized.split(/[\\/]+/);
+    const fileName = segments.at(-1) ?? "";
+    if (!trimmed ||
+        trimmed.length > 512 ||
+        isAbsolute(trimmed) ||
+        normalized === ".." ||
+        normalized.startsWith(`..${sep}`) ||
+        segments.includes("..") ||
+        trimmed.includes("\0") ||
+        /[\u0000-\u001f\u007f-\u009f]/.test(trimmed) ||
+        !(fileName === ".env" || fileName.startsWith(".env.") || fileName.endsWith(".env"))) {
+        throw new SecretVaultError("destination_invalid", "Credential target must be a relative dotenv path inside the workspace (for example .env or config/dev.env).");
+    }
+    return normalized;
+}
+function parseBinding(value) {
+    if (!isRecord(value) || typeof value.workspace !== "string" || typeof value.envFile !== "string") {
+        throw new SecretVaultError("vault_corrupt", "Secret vault binding data is invalid.");
+    }
+    try {
+        return {
+            workspace: validateBindingWorkspace(value.workspace),
+            envFile: validateBindingEnvFile(value.envFile),
+            updatedAt: validateTimestamp(value.updatedAt),
+        };
+    }
+    catch (error) {
+        if (error instanceof SecretVaultError) {
+            throw new SecretVaultError("vault_corrupt", "Secret vault binding data is invalid.");
+        }
+        throw error;
+    }
+}
+export function validateVariableName(name) {
+    try {
+        return validateDotenvVariableName(name);
+    }
+    catch (error) {
+        if (error instanceof SecretDotenvError) {
+            throw new SecretVaultError("invalid_variable", "Environment variable names must use portable dotenv syntax.");
+        }
+        throw error;
+    }
+}
+export function validateSecretValue(value) {
+    try {
+        return validateDotenvValue(value);
+    }
+    catch (error) {
+        if (error instanceof SecretDotenvError) {
+            throw new SecretVaultError(error.message.includes("64 KiB") ? "value_too_large" : "invalid_variable", error.message.includes("64 KiB")
+                ? "A secret value exceeds the 64 KiB limit."
+                : "Secret values cannot contain null bytes.");
+        }
+        throw error;
+    }
+}
+export function validateDotenvProfileDocument(document) {
+    try {
+        return parseDotenvDocument(document);
+    }
+    catch (error) {
+        if (error instanceof SecretDotenvError)
+            throw new SecretVaultError("invalid_dotenv", error.message);
+        throw error;
+    }
+}
+function validateTimestamp(value) {
+    if (typeof value !== "string" || value.length > 64 || Number.isNaN(Date.parse(value))) {
+        throw new SecretVaultError("vault_corrupt", "Secret vault timestamps are invalid.");
+    }
+    return value;
+}
+function parsePayload(value) {
+    if (!isRecord(value) || value.marker !== VAULT_MARKER || !Array.isArray(value.profiles)) {
+        throw new SecretVaultError("vault_corrupt", "Secret vault payload is invalid.");
+    }
+    if (value.profiles.length > MAX_PROFILES) {
+        throw new SecretVaultError("vault_corrupt", "Secret vault profile count exceeds its bound.");
+    }
+    const profileNames = new Set();
+    const profiles = value.profiles.map((candidate) => {
+        if (!isRecord(candidate) || typeof candidate.dotenv !== "string" || !Array.isArray(candidate.bindings)) {
+            throw new SecretVaultError("vault_corrupt", "Secret vault profile data is invalid.");
+        }
+        const profile = validateProfileId(typeof candidate.profile === "string" ? candidate.profile : "");
+        if (profileNames.has(profile))
+            throw new SecretVaultError("vault_corrupt", "Secret vault profiles are duplicated.");
+        profileNames.add(profile);
+        let dotenv;
+        try {
+            dotenv = validateDotenvProfileDocument(candidate.dotenv).document;
+        }
+        catch {
+            throw new SecretVaultError("vault_corrupt", "Secret vault dotenv data is invalid.");
+        }
+        if (candidate.bindings.length > MAX_BINDINGS_PER_PROFILE) {
+            throw new SecretVaultError("vault_corrupt", "Secret vault binding count exceeds its bound.");
+        }
+        const bindingIds = new Set();
+        const bindings = candidate.bindings.map((binding) => {
+            const parsed = parseBinding(binding);
+            const id = `${parsed.workspace}\0${parsed.envFile}`;
+            if (bindingIds.has(id))
+                throw new SecretVaultError("vault_corrupt", "Secret vault bindings are duplicated.");
+            bindingIds.add(id);
+            return parsed;
+        });
+        return {
+            profile,
+            ...(candidate.description !== undefined
+                ? {
+                    description: validateDescription(typeof candidate.description === "string" ? candidate.description : ""),
+                }
+                : {}),
+            createdAt: validateTimestamp(candidate.createdAt),
+            updatedAt: validateTimestamp(candidate.updatedAt),
+            dotenv,
+            bindings: bindings.sort((left, right) => left.workspace.localeCompare(right.workspace) || left.envFile.localeCompare(right.envFile)),
+        };
+    });
+    return { marker: VAULT_MARKER, profiles: profiles.sort((left, right) => left.profile.localeCompare(right.profile)) };
+}
+export function scrubPayload(payload) {
+    for (const profile of payload.profiles)
+        profile.dotenv = "";
+}
+export function assertPassphrase(passphrase, creating) {
+    if (passphrase.length > MAX_PASSPHRASE_CHARS ||
+        passphrase.includes("\0") ||
+        (creating ? passphrase.length < MIN_NEW_PASSPHRASE_CHARS : passphrase.length === 0)) {
+        throw new SecretVaultError("invalid_passphrase", creating
+            ? `The vault passphrase must contain ${MIN_NEW_PASSPHRASE_CHARS}-${MAX_PASSPHRASE_CHARS} characters.`
+            : "The vault passphrase is invalid.");
+    }
+}
+export function sameKdf(left, right) {
+    return (left.algorithm === right.algorithm &&
+        left.salt === right.salt &&
+        left.N === right.N &&
+        left.r === right.r &&
+        left.p === right.p &&
+        left.keyLength === right.keyLength);
+}
+export async function deriveKey(passphrase, kdf) {
+    const salt = Buffer.from(kdf.salt, "base64");
+    const maxmem = Math.max(64 * 1024 * 1024, 128 * kdf.N * kdf.r + 16 * 1024 * 1024);
+    try {
+        return await new Promise((resolveKey, reject) => {
+            scrypt(passphrase, salt, kdf.keyLength, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem }, (error, key) => {
+                if (error)
+                    reject(error);
+                else
+                    resolveKey(key);
+            });
+        });
+    }
+    finally {
+        salt.fill(0);
+    }
+}
+function encryptPayload(payload, key) {
+    let serialized = JSON.stringify(payload);
+    if (Buffer.byteLength(serialized, "utf8") > MAX_VAULT_PAYLOAD_BYTES) {
+        serialized = "";
+        throw new SecretVaultError("vault_too_large", "Secret vault payload exceeds its 2 MiB limit.");
+    }
+    const plaintext = Buffer.from(serialized, "utf8");
+    serialized = "";
+    const iv = randomBytes(IV_LENGTH);
+    try {
+        const cipher = createCipheriv(AES_ALGORITHM, key, iv);
+        cipher.setAAD(VAULT_AAD);
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        try {
+            return {
+                iv: iv.toString("base64"),
+                tag: tag.toString("base64"),
+                ciphertext: ciphertext.toString("base64"),
+            };
+        }
+        finally {
+            tag.fill(0);
+            ciphertext.fill(0);
+        }
+    }
+    finally {
+        plaintext.fill(0);
+        iv.fill(0);
+    }
+}
+export function decryptPayload(ciphertext, key) {
+    const iv = Buffer.from(ciphertext.iv, "base64");
+    const tag = Buffer.from(ciphertext.tag, "base64");
+    const encrypted = Buffer.from(ciphertext.ciphertext, "base64");
+    let plaintext;
+    try {
+        const decipher = createDecipheriv(AES_ALGORITHM, key, iv);
+        decipher.setAAD(VAULT_AAD);
+        decipher.setAuthTag(tag);
+        plaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        if (plaintext.byteLength > MAX_VAULT_PAYLOAD_BYTES) {
+            throw new SecretVaultError("vault_too_large", "Secret vault payload exceeds its 2 MiB limit.");
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(plaintext.toString("utf8"));
+        }
+        catch {
+            throw new SecretVaultError("vault_corrupt", "Secret vault payload is invalid.");
+        }
+        return parsePayload(parsed);
+    }
+    catch (error) {
+        if (error instanceof SecretVaultError)
+            throw error;
+        throw new SecretVaultError("unlock_failed", "The vault passphrase is incorrect or the vault is damaged.");
+    }
+    finally {
+        iv.fill(0);
+        tag.fill(0);
+        encrypted.fill(0);
+        plaintext?.fill(0);
+    }
+}
+export function serializeEnvelope(kdf, payload, key) {
+    const envelope = { version: VAULT_VERSION, kdf, payload: encryptPayload(payload, key) };
+    const serialized = `${JSON.stringify(envelope, null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > MAX_VAULT_FILE_BYTES) {
+        throw new SecretVaultError("vault_too_large", "Secret vault file exceeds its 4 MiB limit.");
+    }
+    return serialized;
+}
+export function profileSummary(profile) {
+    const parsed = validateDotenvProfileDocument(profile.dotenv);
+    return {
+        profile: profile.profile,
+        ...(profile.description ? { description: profile.description } : {}),
+        variableNames: parsed.variables.map((variable) => variable.name),
+        bindings: profile.bindings.map((binding) => ({ ...binding })),
+        createdAt: profile.createdAt,
+        updatedAt: profile.updatedAt,
+    };
+}
+export function serializeVariableValues(values) {
+    return formatDotenvVariables(values);
+}
+//# sourceMappingURL=secret-vault-format.js.map

package/dist/core/secrets/secret-vault-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-vault-format.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault-format.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC5D,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,2BAA2B,GAAG,CAAC,iBAAiB,CAAC;AAC7H,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClG,MAAM,CAAC,MAAM,iCAAiC,GAAG,sCAAsC,CAAC;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AACzE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAC5D,MAAM,qBAAqB,GAAG,IAAI,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAC5E,MAAM,wBAAwB,GAAG,iDAAiD,CAAC;AAwBnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACjC,IAAI,CAAuB;IAEpC,YAAY,IAA0B,EAAE,OAAe,EAAE;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAwFD,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa,EAAE,aAAsB,EAAU;IAC7F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5F,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,KAAK,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,aAAa,CAAC,EAAE,CAAC;QACnH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,KAAK,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAU;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,YAAY,IAAI,KAAK,GAAG,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAY;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO;YACN,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC;YAC3B,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,SAAS,EAAE,UAAU;SACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,KAAc,EAAY;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACpH,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO;QACN,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,KAAK,CAAC,IAAc;QAC1B,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAW,CAAC;QACrC,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,SAAS,EAAE,UAAU;KACrB,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CAAC,KAAc,EAAmB;IACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACtG,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAY;QACtB,GAAG,EAAE,KAAK,CAAC,GAAa;QACxB,UAAU,EAAE,KAAK,CAAC,UAAoB;KACtC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAiB;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACvG;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAU;IAC1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,mBAAmB,CAAC,WAA+B,EAAsB;IACxF,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,4BAA4B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAU;IACnE,IACC,CAAC,UAAU,CAAC,SAAS,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,KAAK;QACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7C,CAAC;QACF,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,sDAAsD,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAAA,CAC5B;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAU;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IACC,CAAC,OAAO;QACR,OAAO,CAAC,MAAM,GAAG,GAAG;QACpB,UAAU,CAAC,OAAO,CAAC;QACnB,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAClF,CAAC;QACF,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,YAAY,CAAC,KAAc,EAAwB;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC;QACJ,OAAO;YACN,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9C,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;SAC7C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAU;IAC1D,IAAI,CAAC;QACJ,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAU;IAC1D,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACzB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,EACzE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,0CAA0C,CAC7C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,6BAA6B,CAAC,QAAgB,EAG5D;IACD,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpG,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAU;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,YAAY,CAAC,KAAc,EAAgB;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,QAAQ,GAA0B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YAC7G,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QAAA,CACd,CAAC,CAAC;QACH,OAAO;YACN,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS;gBACtC,CAAC,CAAC;oBACA,WAAW,EAAE,mBAAmB,CAC/B,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CACtE;iBACD;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;YACjD,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC3G;SACD,CAAC;IAAA,CACF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AAAA,CACrH;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAQ;IACzD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,QAAiB,EAAQ;IAC7E,IACC,UAAU,CAAC,MAAM,GAAG,oBAAoB;QACxC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAClF,CAAC;QACF,MAAM,IAAI,gBAAgB,CACzB,oBAAoB,EACpB,QAAQ;YACP,CAAC,CAAC,qCAAqC,wBAAwB,IAAI,oBAAoB,cAAc;YACrG,CAAC,CAAC,kCAAkC,CACrC,CAAC;IACH,CAAC;AAAA,CACD;AAED,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,KAAe,EAAW;IACjE,OAAO,CACN,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAClC,CAAC;AAAA,CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,GAAa,EAAmB;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;YACxD,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;gBACjG,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,UAAU,CAAC,GAAG,CAAC,CAAC;YAAA,CACrB,CAAC,CAAC;QAAA,CACH,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,cAAc,CAAC,OAAqB,EAAE,GAAW,EAAmB;IAC5E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACrE,UAAU,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,UAAU,GAAG,EAAE,CAAC;IAChB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO;gBACN,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACzC,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;AAAA,CACD;AAED,MAAM,UAAU,cAAc,CAAC,UAA2B,EAAE,GAAW,EAAgB;IACtF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,SAAS,CAAC,UAAU,GAAG,uBAAuB,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AAAA,CACD;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,OAAqB,EAAE,GAAW,EAAU;IAC5F,MAAM,QAAQ,GAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACvG,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QAClE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,MAAM,UAAU,cAAc,CAAC,OAA4B,EAAwB;IAClF,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC;AAAA,CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAsC,EAAU;IACvF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAAA,CACrC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\";\nimport { isAbsolute, normalize, sep } from \"node:path\";\nimport {\n\tformatDotenvVariables,\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tSecretDotenvError,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst VAULT_VERSION = 1;\nexport const VAULT_MARKER = \"pi-secret-vault-v1\";\nconst VAULT_AAD = Buffer.from(\"pi-secret-vault:v1\", \"utf8\");\nconst AES_ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 16;\nexport const DEFAULT_SCRYPT_N = 32_768;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst MIN_SCRYPT_N = 1_024;\nconst MAX_SCRYPT_N = 65_536;\nexport const MAX_VAULT_FILE_BYTES = 4 * 1024 * 1024;\nconst MAX_VAULT_PAYLOAD_BYTES = 2 * 1024 * 1024;\nexport const MAX_PROFILES = 64;\nexport const MAX_VARIABLES_PER_PROFILE = MAX_DOTENV_VARIABLES;\nexport const MAX_BINDINGS_PER_PROFILE = 16;\nconst MAX_PASSPHRASE_CHARS = 4_096;\nconst MIN_NEW_PASSPHRASE_CHARS = 12;\nexport const SECRET_PROFILE_ID_MAX_CHARS = 64;\nexport const SECRET_DESCRIPTION_MAX_CHARS = 240;\nexport const SECRET_PROFILE_ID_PATTERN = `^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,${SECRET_PROFILE_ID_MAX_CHARS - 2}}[A-Za-z0-9])?$`;\nexport { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from \"./secret-dotenv.ts\";\nexport const SECRET_PRINTABLE_METADATA_PATTERN = \"^[^\\\\u0000-\\\\u001f\\\\u007f-\\\\u009f]+$\";\nexport const MANAGED_ENV_HEADER_PREFIX = \"# pi-secret-store:v1 profile=\";\nconst PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);\nconst PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);\nconst WINDOWS_RESERVED_NAME_RE = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/i;\n\nexport type SecretVaultErrorCode =\n\t| \"already_initialized\"\n\t| \"ambiguous_binding\"\n\t| \"binding_missing\"\n\t| \"destination_conflict\"\n\t| \"destination_invalid\"\n\t| \"invalid_description\"\n\t| \"invalid_dotenv\"\n\t| \"invalid_passphrase\"\n\t| \"invalid_profile\"\n\t| \"invalid_variable\"\n\t| \"not_initialized\"\n\t| \"not_unlocked\"\n\t| \"profile_limit\"\n\t| \"profile_missing\"\n\t| \"symlink_refused\"\n\t| \"unlock_failed\"\n\t| \"value_too_large\"\n\t| \"variable_limit\"\n\t| \"vault_corrupt\"\n\t| \"vault_too_large\";\n\nexport class SecretVaultError extends Error {\n\treadonly code: SecretVaultErrorCode;\n\n\tconstructor(code: SecretVaultErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"SecretVaultError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface SecretVariableValue {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface SecretProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tbindings: SecretBindingSummary[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingSummary {\n\tworkspace: string;\n\tenvFile: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingResolution extends SecretBindingSummary {\n\tprofile: string;\n\tdestination: string;\n\tvariableNames: string[];\n}\n\nexport type SecretEnvDestinationState = \"missing\" | \"managed-profile\" | \"managed-other\" | \"unmanaged\";\n\nexport interface SecretMaterializationResult {\n\tprofile: string;\n\tvariableNames: string[];\n\tpreviousState: SecretEnvDestinationState;\n}\n\nexport interface SecretRemovalResult {\n\tprofile: string;\n\tremovedProfile: boolean;\n\tremovedVariableNames: string[];\n\tmanagedMaterializationRemoved: boolean;\n\tboundMaterializationsRemoved: number;\n}\n\nexport interface SecretVaultOptions {\n\tagentDir: string;\n\t/** Test-only cost override. Production callers should retain the default. */\n\tscryptN?: number;\n\tnow?: () => Date;\n\t/** Reset credential-bearing child process state after activation, mutation, or lock. */\n\tonEnvironmentChanged?: () => void;\n}\n\nexport interface VaultKdf {\n\talgorithm: \"scrypt\";\n\tsalt: string;\n\tN: number;\n\tr: number;\n\tp: number;\n\tkeyLength: number;\n}\n\nexport interface VaultCiphertext {\n\tiv: string;\n\ttag: string;\n\tciphertext: string;\n}\n\nexport interface VaultEnvelope {\n\tversion: 1;\n\tkdf: VaultKdf;\n\tpayload: VaultCiphertext;\n}\n\nexport interface SecretProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tdotenv: string;\n\tbindings: SecretBindingSummary[];\n}\n\nexport interface VaultPayload {\n\tmarker: typeof VAULT_MARKER;\n\tprofiles: SecretProfileRecord[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction decodeCanonicalBase64(value: unknown, field: string, expectedBytes?: number): Buffer {\n\tif (typeof value !== \"string\" || value.length === 0 || value.length > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif (decoded.toString(\"base64\") !== value || (expectedBytes !== undefined && decoded.byteLength !== expectedBytes)) {\n\t\tdecoded.fill(0);\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\treturn decoded;\n}\n\nexport function validateScryptN(value: number): number {\n\tif (!Number.isInteger(value) || value < MIN_SCRYPT_N || value > MAX_SCRYPT_N || (value & (value - 1)) !== 0) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are invalid.\");\n\t}\n\treturn value;\n}\n\nexport function createVaultKdf(scryptN: number): VaultKdf {\n\tconst salt = randomBytes(SALT_LENGTH);\n\ttry {\n\t\treturn {\n\t\t\talgorithm: \"scrypt\",\n\t\t\tsalt: salt.toString(\"base64\"),\n\t\t\tN: validateScryptN(scryptN),\n\t\t\tr: SCRYPT_R,\n\t\t\tp: SCRYPT_P,\n\t\t\tkeyLength: KEY_LENGTH,\n\t\t};\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction parseKdf(value: unknown): VaultKdf {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF is missing.\");\n\tif (value.algorithm !== \"scrypt\" || value.r !== SCRYPT_R || value.p !== SCRYPT_P || value.keyLength !== KEY_LENGTH) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are unsupported.\");\n\t}\n\tconst salt = decodeCanonicalBase64(value.salt, \"salt\", SALT_LENGTH);\n\tsalt.fill(0);\n\treturn {\n\t\talgorithm: \"scrypt\",\n\t\tsalt: value.salt as string,\n\t\tN: validateScryptN(value.N as number),\n\t\tr: SCRYPT_R,\n\t\tp: SCRYPT_P,\n\t\tkeyLength: KEY_LENGTH,\n\t};\n}\n\nfunction parseCiphertext(value: unknown): VaultCiphertext {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is missing.\");\n\tconst iv = decodeCanonicalBase64(value.iv, \"IV\", IV_LENGTH);\n\tconst tag = decodeCanonicalBase64(value.tag, \"authentication tag\", AUTH_TAG_LENGTH);\n\tconst ciphertext = decodeCanonicalBase64(value.ciphertext, \"ciphertext\");\n\tiv.fill(0);\n\ttag.fill(0);\n\tciphertext.fill(0);\n\treturn {\n\t\tiv: value.iv as string,\n\t\ttag: value.tag as string,\n\t\tciphertext: value.ciphertext as string,\n\t};\n}\n\nexport function parseEnvelope(text: string): VaultEnvelope {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault data is not valid JSON.\");\n\t}\n\tif (!isRecord(parsed) || parsed.version !== VAULT_VERSION) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault version is unsupported.\");\n\t}\n\treturn { version: VAULT_VERSION, kdf: parseKdf(parsed.kdf), payload: parseCiphertext(parsed.payload) };\n}\n\nexport function validateProfileId(profile: string): string {\n\tif (!PROFILE_ID_RE.test(profile) || WINDOWS_RESERVED_NAME_RE.test(profile)) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Profile names must be portable 1-64 character identifiers using letters, numbers, dot, dash, or underscore.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateDescription(description: string | undefined): string | undefined {\n\tif (description === undefined) return undefined;\n\tconst normalized = description.trim();\n\tif (!normalized || normalized.length > SECRET_DESCRIPTION_MAX_CHARS || !PRINTABLE_METADATA_RE.test(normalized)) {\n\t\tthrow new SecretVaultError(\"invalid_description\", \"Secret profile descriptions must be short printable text.\");\n\t}\n\treturn normalized;\n}\n\nexport function validateBindingWorkspace(workspace: string): string {\n\tif (\n\t\t!isAbsolute(workspace) ||\n\t\tworkspace.length > 4_096 ||\n\t\tworkspace.includes(\"\\0\") ||\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(workspace)\n\t) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential workspace must be an absolute local path.\");\n\t}\n\treturn normalize(workspace);\n}\n\nexport function validateBindingEnvFile(envFile: string): string {\n\tconst trimmed = envFile.trim();\n\tconst normalized = normalize(trimmed);\n\tconst segments = normalized.split(/[\\\\/]+/);\n\tconst fileName = segments.at(-1) ?? \"\";\n\tif (\n\t\t!trimmed ||\n\t\ttrimmed.length > 512 ||\n\t\tisAbsolute(trimmed) ||\n\t\tnormalized === \"..\" ||\n\t\tnormalized.startsWith(`..${sep}`) ||\n\t\tsegments.includes(\"..\") ||\n\t\ttrimmed.includes(\"\\0\") ||\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(trimmed) ||\n\t\t!(fileName === \".env\" || fileName.startsWith(\".env.\") || fileName.endsWith(\".env\"))\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential target must be a relative dotenv path inside the workspace (for example .env or config/dev.env).\",\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction parseBinding(value: unknown): SecretBindingSummary {\n\tif (!isRecord(value) || typeof value.workspace !== \"string\" || typeof value.envFile !== \"string\") {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t}\n\ttry {\n\t\treturn {\n\t\t\tworkspace: validateBindingWorkspace(value.workspace),\n\t\t\tenvFile: validateBindingEnvFile(value.envFile),\n\t\t\tupdatedAt: validateTimestamp(value.updatedAt),\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateVariableName(name: string): string {\n\ttry {\n\t\treturn validateDotenvVariableName(name);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable names must use portable dotenv syntax.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateSecretValue(value: string): string {\n\ttry {\n\t\treturn validateDotenvValue(value);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\terror.message.includes(\"64 KiB\") ? \"value_too_large\" : \"invalid_variable\",\n\t\t\t\terror.message.includes(\"64 KiB\")\n\t\t\t\t\t? \"A secret value exceeds the 64 KiB limit.\"\n\t\t\t\t\t: \"Secret values cannot contain null bytes.\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateDotenvProfileDocument(document: string): {\n\tdocument: string;\n\tvariables: SecretVariableValue[];\n} {\n\ttry {\n\t\treturn parseDotenvDocument(document);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) throw new SecretVaultError(\"invalid_dotenv\", error.message);\n\t\tthrow error;\n\t}\n}\n\nfunction validateTimestamp(value: unknown): string {\n\tif (typeof value !== \"string\" || value.length > 64 || Number.isNaN(Date.parse(value))) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault timestamps are invalid.\");\n\t}\n\treturn value;\n}\n\nfunction parsePayload(value: unknown): VaultPayload {\n\tif (!isRecord(value) || value.marker !== VAULT_MARKER || !Array.isArray(value.profiles)) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t}\n\tif (value.profiles.length > MAX_PROFILES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile count exceeds its bound.\");\n\t}\n\tconst profileNames = new Set<string>();\n\tconst profiles: SecretProfileRecord[] = value.profiles.map((candidate) => {\n\t\tif (!isRecord(candidate) || typeof candidate.dotenv !== \"string\" || !Array.isArray(candidate.bindings)) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile data is invalid.\");\n\t\t}\n\t\tconst profile = validateProfileId(typeof candidate.profile === \"string\" ? candidate.profile : \"\");\n\t\tif (profileNames.has(profile))\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profiles are duplicated.\");\n\t\tprofileNames.add(profile);\n\t\tlet dotenv: string;\n\t\ttry {\n\t\t\tdotenv = validateDotenvProfileDocument(candidate.dotenv).document;\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault dotenv data is invalid.\");\n\t\t}\n\t\tif (candidate.bindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding count exceeds its bound.\");\n\t\t}\n\t\tconst bindingIds = new Set<string>();\n\t\tconst bindings = candidate.bindings.map((binding) => {\n\t\t\tconst parsed = parseBinding(binding);\n\t\t\tconst id = `${parsed.workspace}\\0${parsed.envFile}`;\n\t\t\tif (bindingIds.has(id)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault bindings are duplicated.\");\n\t\t\tbindingIds.add(id);\n\t\t\treturn parsed;\n\t\t});\n\t\treturn {\n\t\t\tprofile,\n\t\t\t...(candidate.description !== undefined\n\t\t\t\t? {\n\t\t\t\t\t\tdescription: validateDescription(\n\t\t\t\t\t\t\ttypeof candidate.description === \"string\" ? candidate.description : \"\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\tcreatedAt: validateTimestamp(candidate.createdAt),\n\t\t\tupdatedAt: validateTimestamp(candidate.updatedAt),\n\t\t\tdotenv,\n\t\t\tbindings: bindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) || left.envFile.localeCompare(right.envFile),\n\t\t\t),\n\t\t};\n\t});\n\treturn { marker: VAULT_MARKER, profiles: profiles.sort((left, right) => left.profile.localeCompare(right.profile)) };\n}\n\nexport function scrubPayload(payload: VaultPayload): void {\n\tfor (const profile of payload.profiles) profile.dotenv = \"\";\n}\n\nexport function assertPassphrase(passphrase: string, creating: boolean): void {\n\tif (\n\t\tpassphrase.length > MAX_PASSPHRASE_CHARS ||\n\t\tpassphrase.includes(\"\\0\") ||\n\t\t(creating ? passphrase.length < MIN_NEW_PASSPHRASE_CHARS : passphrase.length === 0)\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_passphrase\",\n\t\t\tcreating\n\t\t\t\t? `The vault passphrase must contain ${MIN_NEW_PASSPHRASE_CHARS}-${MAX_PASSPHRASE_CHARS} characters.`\n\t\t\t\t: \"The vault passphrase is invalid.\",\n\t\t);\n\t}\n}\n\nexport function sameKdf(left: VaultKdf, right: VaultKdf): boolean {\n\treturn (\n\t\tleft.algorithm === right.algorithm &&\n\t\tleft.salt === right.salt &&\n\t\tleft.N === right.N &&\n\t\tleft.r === right.r &&\n\t\tleft.p === right.p &&\n\t\tleft.keyLength === right.keyLength\n\t);\n}\n\nexport async function deriveKey(passphrase: string, kdf: VaultKdf): Promise<Buffer> {\n\tconst salt = Buffer.from(kdf.salt, \"base64\");\n\tconst maxmem = Math.max(64 * 1024 * 1024, 128 * kdf.N * kdf.r + 16 * 1024 * 1024);\n\ttry {\n\t\treturn await new Promise<Buffer>((resolveKey, reject) => {\n\t\t\tscrypt(passphrase, salt, kdf.keyLength, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem }, (error, key) => {\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolveKey(key);\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction encryptPayload(payload: VaultPayload, key: Buffer): VaultCiphertext {\n\tlet serialized = JSON.stringify(payload);\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_PAYLOAD_BYTES) {\n\t\tserialized = \"\";\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t}\n\tconst plaintext = Buffer.from(serialized, \"utf8\");\n\tserialized = \"\";\n\tconst iv = randomBytes(IV_LENGTH);\n\ttry {\n\t\tconst cipher = createCipheriv(AES_ALGORITHM, key, iv);\n\t\tcipher.setAAD(VAULT_AAD);\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tiv: iv.toString(\"base64\"),\n\t\t\t\ttag: tag.toString(\"base64\"),\n\t\t\t\tciphertext: ciphertext.toString(\"base64\"),\n\t\t\t};\n\t\t} finally {\n\t\t\ttag.fill(0);\n\t\t\tciphertext.fill(0);\n\t\t}\n\t} finally {\n\t\tplaintext.fill(0);\n\t\tiv.fill(0);\n\t}\n}\n\nexport function decryptPayload(ciphertext: VaultCiphertext, key: Buffer): VaultPayload {\n\tconst iv = Buffer.from(ciphertext.iv, \"base64\");\n\tconst tag = Buffer.from(ciphertext.tag, \"base64\");\n\tconst encrypted = Buffer.from(ciphertext.ciphertext, \"base64\");\n\tlet plaintext: Buffer | undefined;\n\ttry {\n\t\tconst decipher = createDecipheriv(AES_ALGORITHM, key, iv);\n\t\tdecipher.setAAD(VAULT_AAD);\n\t\tdecipher.setAuthTag(tag);\n\t\tplaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\t\tif (plaintext.byteLength > MAX_VAULT_PAYLOAD_BYTES) {\n\t\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t\t}\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(plaintext.toString(\"utf8\"));\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t\t}\n\t\treturn parsePayload(parsed);\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) throw error;\n\t\tthrow new SecretVaultError(\"unlock_failed\", \"The vault passphrase is incorrect or the vault is damaged.\");\n\t} finally {\n\t\tiv.fill(0);\n\t\ttag.fill(0);\n\t\tencrypted.fill(0);\n\t\tplaintext?.fill(0);\n\t}\n}\n\nexport function serializeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): string {\n\tconst envelope: VaultEnvelope = { version: VAULT_VERSION, kdf, payload: encryptPayload(payload, key) };\n\tconst serialized = `${JSON.stringify(envelope, null, 2)}\\n`;\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault file exceeds its 4 MiB limit.\");\n\t}\n\treturn serialized;\n}\n\nexport function profileSummary(profile: SecretProfileRecord): SecretProfileSummary {\n\tconst parsed = validateDotenvProfileDocument(profile.dotenv);\n\treturn {\n\t\tprofile: profile.profile,\n\t\t...(profile.description ? { description: profile.description } : {}),\n\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\tcreatedAt: profile.createdAt,\n\t\tupdatedAt: profile.updatedAt,\n\t};\n}\n\nexport function serializeVariableValues(values: readonly SecretVariableValue[]): string {\n\treturn formatDotenvVariables(values);\n}\n"]}