@centient/secrets 0.10.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +355 -7
- package/dist/audit/hmac-chain.d.ts +117 -0
- package/dist/audit/hmac-chain.d.ts.map +1 -0
- package/dist/audit/hmac-chain.js +811 -0
- package/dist/audit/hmac-chain.js.map +1 -0
- package/dist/audit/ocsf.d.ts +108 -0
- package/dist/audit/ocsf.d.ts.map +1 -0
- package/dist/audit/ocsf.js +204 -0
- package/dist/audit/ocsf.js.map +1 -0
- package/dist/cli/hidden-prompt.d.ts.map +1 -1
- package/dist/cli/hidden-prompt.js +55 -10
- package/dist/cli/hidden-prompt.js.map +1 -1
- package/dist/cli/messages.d.ts +40 -8
- package/dist/cli/messages.d.ts.map +1 -1
- package/dist/cli/messages.js +34 -8
- package/dist/cli/messages.js.map +1 -1
- package/dist/client.d.ts +26 -0
- package/dist/client.d.ts.map +1 -0
- package/dist/client.js +129 -0
- package/dist/client.js.map +1 -0
- package/dist/compatibility.d.ts +199 -0
- package/dist/compatibility.d.ts.map +1 -0
- package/dist/compatibility.js +419 -0
- package/dist/compatibility.js.map +1 -0
- package/dist/index.d.ts +19 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +16 -2
- package/dist/index.js.map +1 -1
- package/dist/policies/audit-trail.d.ts +25 -0
- package/dist/policies/audit-trail.d.ts.map +1 -0
- package/dist/policies/audit-trail.js +31 -0
- package/dist/policies/audit-trail.js.map +1 -0
- package/dist/sinks/index.d.ts +9 -0
- package/dist/sinks/index.d.ts.map +1 -0
- package/dist/sinks/index.js +5 -0
- package/dist/sinks/index.js.map +1 -0
- package/dist/sinks/jsonl.d.ts +16 -0
- package/dist/sinks/jsonl.d.ts.map +1 -0
- package/dist/sinks/jsonl.js +51 -0
- package/dist/sinks/jsonl.js.map +1 -0
- package/dist/sinks/otel.d.ts +22 -0
- package/dist/sinks/otel.d.ts.map +1 -0
- package/dist/sinks/otel.js +155 -0
- package/dist/sinks/otel.js.map +1 -0
- package/dist/sinks/queue.d.ts +12 -0
- package/dist/sinks/queue.d.ts.map +1 -0
- package/dist/sinks/queue.js +89 -0
- package/dist/sinks/queue.js.map +1 -0
- package/dist/sinks/syslog.d.ts +17 -0
- package/dist/sinks/syslog.d.ts.map +1 -0
- package/dist/sinks/syslog.js +103 -0
- package/dist/sinks/syslog.js.map +1 -0
- package/dist/sinks/types.d.ts +27 -0
- package/dist/sinks/types.d.ts.map +1 -0
- package/dist/sinks/types.js +18 -0
- package/dist/sinks/types.js.map +1 -0
- package/dist/vault/policy.d.ts +64 -34
- package/dist/vault/policy.d.ts.map +1 -1
- package/dist/vault/policy.js +109 -67
- package/dist/vault/policy.js.map +1 -1
- package/dist/vault/session-vault.d.ts +43 -0
- package/dist/vault/session-vault.d.ts.map +1 -1
- package/dist/vault/session-vault.js +323 -36
- package/dist/vault/session-vault.js.map +1 -1
- package/dist/vault/sidecar.d.ts +9 -0
- package/dist/vault/sidecar.d.ts.map +1 -1
- package/dist/vault/sidecar.js +72 -3
- package/dist/vault/sidecar.js.map +1 -1
- package/dist/vault/types.d.ts +16 -9
- package/dist/vault/types.d.ts.map +1 -1
- package/dist/vault/vault-env.d.ts +41 -62
- package/dist/vault/vault-env.d.ts.map +1 -1
- package/dist/vault/vault-env.js +139 -75
- package/dist/vault/vault-env.js.map +1 -1
- package/dist/vault/vault-gpg.d.ts +1 -0
- package/dist/vault/vault-gpg.d.ts.map +1 -1
- package/dist/vault/vault-gpg.js +1 -0
- package/dist/vault/vault-gpg.js.map +1 -1
- package/dist/vault/vault-libsecret.d.ts +1 -0
- package/dist/vault/vault-libsecret.d.ts.map +1 -1
- package/dist/vault/vault-libsecret.js +7 -6
- package/dist/vault/vault-libsecret.js.map +1 -1
- package/dist/vault/vault-onepassword.d.ts +1 -0
- package/dist/vault/vault-onepassword.d.ts.map +1 -1
- package/dist/vault/vault-onepassword.js +1 -0
- package/dist/vault/vault-onepassword.js.map +1 -1
- package/dist/vault/vault-utils.d.ts +7 -6
- package/dist/vault/vault-utils.d.ts.map +1 -1
- package/dist/vault/vault-utils.js +8 -7
- package/dist/vault/vault-utils.js.map +1 -1
- package/dist/vault/vault-windows.d.ts +2 -1
- package/dist/vault/vault-windows.d.ts.map +1 -1
- package/dist/vault/vault-windows.js +12 -8
- package/dist/vault/vault-windows.js.map +1 -1
- package/dist/vault/vault.d.ts +6 -7
- package/dist/vault/vault.d.ts.map +1 -1
- package/dist/vault/vault.js +37 -193
- package/dist/vault/vault.js.map +1 -1
- package/package.json +8 -2
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* key is unaddressable here, and reporting it as a failed write or an absent
|
|
13
13
|
* credential would be indistinguishable from the ordinary miss.
|
|
14
14
|
*/
|
|
15
|
-
import {
|
|
15
|
+
import { execFileSync } from "child_process";
|
|
16
16
|
import { assertValidKey } from "./vault-utils.js";
|
|
17
17
|
// =============================================================================
|
|
18
18
|
// Constants
|
|
@@ -40,13 +40,14 @@ let dbusFallbackWarned = false;
|
|
|
40
40
|
* }
|
|
41
41
|
*/
|
|
42
42
|
export class LibsecretVault {
|
|
43
|
+
name = "libsecret";
|
|
43
44
|
/**
|
|
44
45
|
* Returns true if `secret-tool` is available on this system.
|
|
45
46
|
* Uses `which secret-tool` — returns false if not found or command fails.
|
|
46
47
|
*/
|
|
47
48
|
static detect() {
|
|
48
49
|
try {
|
|
49
|
-
|
|
50
|
+
execFileSync("which", ["secret-tool"], {
|
|
50
51
|
encoding: "utf8",
|
|
51
52
|
stdio: ["pipe", "pipe", "pipe"],
|
|
52
53
|
});
|
|
@@ -66,7 +67,7 @@ export class LibsecretVault {
|
|
|
66
67
|
store(key, value) {
|
|
67
68
|
assertValidKey(key, "write");
|
|
68
69
|
try {
|
|
69
|
-
|
|
70
|
+
execFileSync("secret-tool", ["store", "--label", LABEL, "service", SERVICE_ATTR, "key", key], {
|
|
70
71
|
encoding: "utf8",
|
|
71
72
|
stdio: ["pipe", "pipe", "pipe"],
|
|
72
73
|
input: value,
|
|
@@ -86,7 +87,7 @@ export class LibsecretVault {
|
|
|
86
87
|
retrieve(key) {
|
|
87
88
|
assertValidKey(key, "read");
|
|
88
89
|
try {
|
|
89
|
-
const result =
|
|
90
|
+
const result = execFileSync("secret-tool", ["lookup", "service", SERVICE_ATTR, "key", key], {
|
|
90
91
|
encoding: "utf8",
|
|
91
92
|
stdio: ["pipe", "pipe", "pipe"],
|
|
92
93
|
});
|
|
@@ -106,7 +107,7 @@ export class LibsecretVault {
|
|
|
106
107
|
delete(key) {
|
|
107
108
|
assertValidKey(key, "delete");
|
|
108
109
|
try {
|
|
109
|
-
|
|
110
|
+
execFileSync("secret-tool", ["clear", "service", SERVICE_ATTR, "key", key], {
|
|
110
111
|
encoding: "utf8",
|
|
111
112
|
stdio: ["pipe", "pipe", "pipe"],
|
|
112
113
|
});
|
|
@@ -239,7 +240,7 @@ export class LibsecretVault {
|
|
|
239
240
|
listKeysViaSecretTool(prefix) {
|
|
240
241
|
let output;
|
|
241
242
|
try {
|
|
242
|
-
output =
|
|
243
|
+
output = execFileSync("secret-tool", ["search", "--all", "service", SERVICE_ATTR], {
|
|
243
244
|
encoding: "utf8",
|
|
244
245
|
stdio: ["pipe", "pipe", "pipe"],
|
|
245
246
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-libsecret.js","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"vault-libsecret.js","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,KAAK,GAAG,eAAe,CAAC;AAE9B;;;;;GAKG;AACH,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,WAAW,CAAC;IAE5B;;;OAGG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE;gBACrC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,YAAY,CACV,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,EAChE;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,KAAK;aACb,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,EAC/C;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,YAAY,CACV,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,EAC9C;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,qBAAqB,CAAC,GAAY;QACxC,IAAI,kBAAkB;YAAE,OAAO;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACxD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChE,kBAAkB,GAAG,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE;YACvE,0EAA0E;YAC1E,mCAAmC,GAAG,IAAI,CAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,MAAe;QAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,CACzC,yBAAyB,EACzB,0BAA0B,CAC3B,CAAC;YACF,oEAAoE;YACpE,kEAAkE;YAClE,+FAA+F;YAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,gCAAgC,CAAQ,CAAC;YAEjF,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,WAAW,CAClD,EAAE,OAAO,EAAE,YAAY,EAAE,CACF,CAAC;YAE1B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAa,EAAE,CAAC;YAE1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CACtC,yBAAyB,EACzB,QAAQ,CACT,CAAC;gBACF,gHAAgH;gBAChH,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,iCAAiC,CAAQ,CAAC;gBAC7E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAC3B,6BAA6B,EAC7B,YAAY,CACgD,CAAC;gBAE/D,6DAA6D;gBAC7D,gEAAgE;gBAChE,8DAA8D;gBAC9D,4CAA4C;gBAC5C,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAE3D,IAAI,MAA0B,CAAC;gBAC/B,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAChD,IAAI,QAAQ,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;wBAC9B,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC;wBAC1B,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,MAAe;QAC3C,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CACnB,aAAa,EACb,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,EAC5C;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;YAC3D,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,SAAS;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
|
|
@@ -42,6 +42,7 @@ export interface OnePasswordVaultOptions extends OnePasswordBackendConfig {
|
|
|
42
42
|
now?: () => number;
|
|
43
43
|
}
|
|
44
44
|
export declare class OnePasswordVault implements VaultBackend {
|
|
45
|
+
readonly name = "1password";
|
|
45
46
|
private readonly vault;
|
|
46
47
|
private readonly tag;
|
|
47
48
|
private readonly now;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-onepassword.d.ts","sourceRoot":"","sources":["../../src/vault/vault-onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAa1E,6DAA6D;AAC7D,eAAO,MAAM,cAAc,aAAa,CAAC;AAKzC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAM1C,4CAA4C;AAC5C,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAMD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,OAAO,CAAC,SAAS,CAAsD;IACvE,OAAO,CAAC,MAAM,CAAS;IAEvB;;;;;OAKG;gBACS,MAAM,EAAE,uBAAuB;IAa3C;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAKxC;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA2B1C;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAepC;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAa5B;;;;;;;;OAQG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBlD,OAAO,CAAC,SAAS;IAsDjB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,mBAAmB;IAI3B;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ;CAWjB"}
|
|
1
|
+
{"version":3,"file":"vault-onepassword.d.ts","sourceRoot":"","sources":["../../src/vault/vault-onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAa1E,6DAA6D;AAC7D,eAAO,MAAM,cAAc,aAAa,CAAC;AAKzC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAM1C,4CAA4C;AAC5C,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAMD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,QAAQ,CAAC,IAAI,eAAe;IAE5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,OAAO,CAAC,SAAS,CAAsD;IACvE,OAAO,CAAC,MAAM,CAAS;IAEvB;;;;;OAKG;gBACS,MAAM,EAAE,uBAAuB;IAa3C;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAKxC;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA2B1C;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAepC;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAa5B;;;;;;;;OAQG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBlD,OAAO,CAAC,SAAS;IAsDjB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,mBAAmB;IAI3B;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ;CAWjB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-onepassword.js","sourceRoot":"","sources":["../../src/vault/vault-onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,WAAW,EACX,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,uDAAuD;AACvD,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAe1C,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;
|
|
1
|
+
{"version":3,"file":"vault-onepassword.js","sourceRoot":"","sources":["../../src/vault/vault-onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,WAAW,EACX,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,uDAAuD;AACvD,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAe1C,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,WAAW,CAAC;IAEX,KAAK,CAAS;IACd,GAAG,CAAS;IACZ,GAAG,CAAe;IAE3B,SAAS,GAAiD,IAAI,CAAC;IAC/D,MAAM,GAAG,KAAK,CAAC;IAEvB;;;;;OAKG;IACH,YAAY,MAA+B;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;QAChD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,OAAgB;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAChB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SACvD,CAAC;QAEF,IAAI,CAAC;YACH,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE;gBAC9C,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3B,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CACjB,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC,EACnD,EAAE,SAAS,EAAE,mBAAmB,EAAE,CACnC,CAAC;YACF,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG;gBACf,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;aAC7C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,SAAS;QACf,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,KAAK,CACT,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAC5E,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,qEAAqE;YACrE,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAEtC,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAA4B,CAAC,KAAK;YACrC,CAAC,CAAC,SAAS,CACd;aACA,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,2EAA2E;IAC3E,oBAAoB;IACpB,EAAE;IACF,4EAA4E;IAC5E,iEAAiE;IACjE,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,qEAAqE;IACrE,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,8DAA8D;IAC9D,2EAA2E;IAC3E,4CAA4C;IAEpC,UAAU,CAAC,GAAW;QAC5B,IAAI,CAAC;YACH,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACpD,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACxD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAEO,mBAAmB;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,EAAU,EAAE,GAAkB,EAAE,GAAY;QAC3D,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO;QACxD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,EAAE,cAAc,MAAM,KAAK,MAAM,IAAI;YAC3E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;CACF"}
|
|
@@ -6,9 +6,10 @@
|
|
|
6
6
|
* The key grammar is a **package-wide invariant**, not a per-backend
|
|
7
7
|
* preference: `vault.ts` enforces it once at the cascade before any backend
|
|
8
8
|
* is dispatched to (#168), and each backend re-asserts it so that a directly
|
|
9
|
-
* constructed backend cannot bypass the rule
|
|
10
|
-
*
|
|
11
|
-
* is
|
|
9
|
+
* constructed backend cannot bypass the rule. Several backends place keys in
|
|
10
|
+
* subprocess argv or an `op://` reference path; the grammar keeps that shared
|
|
11
|
+
* namespace portable and is defense in depth, never the subprocess injection
|
|
12
|
+
* boundary.
|
|
12
13
|
*/
|
|
13
14
|
/**
|
|
14
15
|
* Returns true if the given credential key name is valid.
|
|
@@ -21,9 +22,9 @@
|
|
|
21
22
|
* Hyphens and dots are both permitted as namespace separators so callers
|
|
22
23
|
* can choose whichever convention reads best (`soma-anthropic-token1`,
|
|
23
24
|
* `soma.anthropic.token1`). Underscores, uppercase, whitespace, and
|
|
24
|
-
* shell metacharacters are deliberately rejected
|
|
25
|
-
*
|
|
26
|
-
*
|
|
25
|
+
* shell metacharacters are deliberately rejected to keep the cross-backend
|
|
26
|
+
* namespace portable. Subprocess callers must still use structural argv/stdin
|
|
27
|
+
* separation rather than treating this grammar as an injection boundary.
|
|
27
28
|
*/
|
|
28
29
|
export declare function isValidKey(key: string): boolean;
|
|
29
30
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-utils.d.ts","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"vault-utils.d.ts","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAErE;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,IAAI,CAGzE;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,IAAI,CAGlF"}
|
|
@@ -6,9 +6,10 @@
|
|
|
6
6
|
* The key grammar is a **package-wide invariant**, not a per-backend
|
|
7
7
|
* preference: `vault.ts` enforces it once at the cascade before any backend
|
|
8
8
|
* is dispatched to (#168), and each backend re-asserts it so that a directly
|
|
9
|
-
* constructed backend cannot bypass the rule
|
|
10
|
-
*
|
|
11
|
-
* is
|
|
9
|
+
* constructed backend cannot bypass the rule. Several backends place keys in
|
|
10
|
+
* subprocess argv or an `op://` reference path; the grammar keeps that shared
|
|
11
|
+
* namespace portable and is defense in depth, never the subprocess injection
|
|
12
|
+
* boundary.
|
|
12
13
|
*/
|
|
13
14
|
import { InvalidCredentialKeyError } from "./session-vault-errors.js";
|
|
14
15
|
/**
|
|
@@ -31,9 +32,9 @@ const VALID_KEY_RE = /^[a-z0-9][a-z0-9.-]*[a-z0-9]$/;
|
|
|
31
32
|
* Hyphens and dots are both permitted as namespace separators so callers
|
|
32
33
|
* can choose whichever convention reads best (`soma-anthropic-token1`,
|
|
33
34
|
* `soma.anthropic.token1`). Underscores, uppercase, whitespace, and
|
|
34
|
-
* shell metacharacters are deliberately rejected
|
|
35
|
-
*
|
|
36
|
-
*
|
|
35
|
+
* shell metacharacters are deliberately rejected to keep the cross-backend
|
|
36
|
+
* namespace portable. Subprocess callers must still use structural argv/stdin
|
|
37
|
+
* separation rather than treating this grammar as an injection boundary.
|
|
37
38
|
*/
|
|
38
39
|
export function isValidKey(key) {
|
|
39
40
|
return VALID_KEY_RE.test(key) && key.length <= 64;
|
|
@@ -48,7 +49,7 @@ export function isValidKey(key) {
|
|
|
48
49
|
* a separator), so validating a prefix with `isValidKey` would reject the
|
|
49
50
|
* documented usage. A prefix therefore relaxes exactly one rule — the trailing
|
|
50
51
|
* character may be a separator — and keeps the rest, since a prefix reaches
|
|
51
|
-
* the same argv /
|
|
52
|
+
* the same subprocess argv / `op://` positions a key does.
|
|
52
53
|
*/
|
|
53
54
|
const VALID_KEY_PREFIX_RE = /^[a-z0-9][a-z0-9.-]*$/;
|
|
54
55
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-utils.js","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"vault-utils.js","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,6EAA6E;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9B,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAuB;IACjE,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC5B,MAAM,IAAI,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,SAAuB;IAC1E,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC"}
|
|
@@ -33,6 +33,7 @@ import type { VaultBackend } from "./types.js";
|
|
|
33
33
|
* }
|
|
34
34
|
*/
|
|
35
35
|
export declare class WindowsVault implements VaultBackend {
|
|
36
|
+
readonly name = "windows";
|
|
36
37
|
/**
|
|
37
38
|
* Returns true if running inside a WSL environment where powershell.exe is
|
|
38
39
|
* accessible.
|
|
@@ -53,7 +54,7 @@ export declare class WindowsVault implements VaultBackend {
|
|
|
53
54
|
* as the username and `value` as the password.
|
|
54
55
|
*
|
|
55
56
|
* @param key - Logical key name (e.g. 'auth-token', 'refresh-token')
|
|
56
|
-
* @param value - The credential value to store
|
|
57
|
+
* @param value - The credential value to store (UTF-8/base64 over stdin)
|
|
57
58
|
* @returns true on success, false if storage fails
|
|
58
59
|
*/
|
|
59
60
|
store(key: string, value: string): boolean;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-windows.d.ts","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"vault-windows.d.ts","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAgD/C;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAa,YAAW,YAAY;IAC/C,QAAQ,CAAC,IAAI,aAAa;IAE1B;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAoBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAqB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAsB5B;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CA2BnD"}
|
|
@@ -40,12 +40,13 @@ function escapePsValue(value) {
|
|
|
40
40
|
* Executes a PowerShell command via powershell.exe with no profile and
|
|
41
41
|
* non-interactive mode. Returns stdout trimmed, or null on error.
|
|
42
42
|
*
|
|
43
|
-
* Uses spawnSync to bypass the shell
|
|
44
|
-
*
|
|
43
|
+
* Uses spawnSync to bypass the OS shell. Credential values are UTF-8/base64
|
|
44
|
+
* encoded on stdin and decoded by a fixed PowerShell fragment, so arbitrary
|
|
45
|
+
* value bytes never enter the interpreter command string.
|
|
45
46
|
*/
|
|
46
|
-
function runPowershell(command) {
|
|
47
|
+
function runPowershell(command, input) {
|
|
47
48
|
try {
|
|
48
|
-
const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8" });
|
|
49
|
+
const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8", input });
|
|
49
50
|
if (result.error || result.status !== 0)
|
|
50
51
|
return null;
|
|
51
52
|
return result.stdout.trim();
|
|
@@ -71,6 +72,7 @@ function runPowershell(command) {
|
|
|
71
72
|
* }
|
|
72
73
|
*/
|
|
73
74
|
export class WindowsVault {
|
|
75
|
+
name = "windows";
|
|
74
76
|
/**
|
|
75
77
|
* Returns true if running inside a WSL environment where powershell.exe is
|
|
76
78
|
* accessible.
|
|
@@ -118,22 +120,24 @@ export class WindowsVault {
|
|
|
118
120
|
* as the username and `value` as the password.
|
|
119
121
|
*
|
|
120
122
|
* @param key - Logical key name (e.g. 'auth-token', 'refresh-token')
|
|
121
|
-
* @param value - The credential value to store
|
|
123
|
+
* @param value - The credential value to store (UTF-8/base64 over stdin)
|
|
122
124
|
* @returns true on success, false if storage fails
|
|
123
125
|
*/
|
|
124
126
|
store(key, value) {
|
|
125
127
|
assertValidKey(key, "write");
|
|
126
128
|
const escapedKey = escapePsValue(key);
|
|
127
|
-
const
|
|
129
|
+
const encodedValue = Buffer.from(value, "utf8").toString("base64");
|
|
128
130
|
const command = [
|
|
129
131
|
"& {",
|
|
130
132
|
"[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];",
|
|
133
|
+
"$passwordBytes = [System.Convert]::FromBase64String([Console]::In.ReadToEnd());",
|
|
134
|
+
"$password = [System.Text.Encoding]::UTF8.GetString($passwordBytes);",
|
|
131
135
|
"$vault = New-Object Windows.Security.Credentials.PasswordVault;",
|
|
132
|
-
`$cred = New-Object Windows.Security.Credentials.PasswordCredential('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}',
|
|
136
|
+
`$cred = New-Object Windows.Security.Credentials.PasswordCredential('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}', $password);`,
|
|
133
137
|
"$vault.Add($cred)",
|
|
134
138
|
"}",
|
|
135
139
|
].join(" ");
|
|
136
|
-
const result = runPowershell(command);
|
|
140
|
+
const result = runPowershell(command, encodedValue);
|
|
137
141
|
return result !== null;
|
|
138
142
|
}
|
|
139
143
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAQ,MAAM,CAAC,MAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,SAAS,CAAC;IAE1B;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,6CAA6C;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;gBACpD,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iFAAiF;YACjF,qEAAqE;YACrE,iEAAiE;YACjE,uEAAuE,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,gBAAgB;YACpI,mBAAmB;YACnB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,2BAA2B;YAC3B,gBAAgB;YAChB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,sBAAsB;YACtB,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,sCAAsC,aAAa,CAAC,aAAa,CAAC,KAAK;YACvE,yCAAyC;YACzC,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
|
package/dist/vault/vault.d.ts
CHANGED
|
@@ -8,8 +8,9 @@
|
|
|
8
8
|
* 4. GpgVault — GPG-encrypted files (Linux / WSL)
|
|
9
9
|
* 5. EnvVault — Environment variable fallback (always available)
|
|
10
10
|
*
|
|
11
|
-
* The
|
|
11
|
+
* The default backend is selected lazily on first use by calling each backend's
|
|
12
12
|
* static `detect()` method in order and choosing the first one that returns true.
|
|
13
|
+
* A successful selection is then reused for the lifetime of this module.
|
|
13
14
|
*
|
|
14
15
|
* **Explicit selection (ADR-004) sits in front of that cascade.** `secrets.backend`
|
|
15
16
|
* (or `CENTIENT_SECRETS_BACKEND`) names a backend directly and fails closed if it
|
|
@@ -49,6 +50,7 @@ export declare const AUTH_KEYCHAIN_SERVICE = "centient-auth";
|
|
|
49
50
|
*/
|
|
50
51
|
export declare class KeychainVault implements VaultBackend {
|
|
51
52
|
private readonly deps;
|
|
53
|
+
readonly name = "keychain";
|
|
52
54
|
/**
|
|
53
55
|
* @param deps - Injection seam for the `security` CLI and the
|
|
54
56
|
* platform/environment that decide the read path. Omitted in production;
|
|
@@ -74,18 +76,15 @@ export declare class KeychainVault implements VaultBackend {
|
|
|
74
76
|
*/
|
|
75
77
|
probe(key: string): SecretState;
|
|
76
78
|
}
|
|
77
|
-
/**
|
|
78
|
-
* Returns true if the in-process session is still within the TTL window.
|
|
79
|
-
* This does NOT validate the token itself — use validateToken() for that.
|
|
80
|
-
*/
|
|
81
|
-
export declare function isSessionValid(): boolean;
|
|
82
79
|
/**
|
|
83
80
|
* Returns the type identifier for the active vault backend.
|
|
84
81
|
*
|
|
85
82
|
* Useful for diagnostics and health checks to know which backend was selected
|
|
86
|
-
*
|
|
83
|
+
* on first use (e.g. "keychain", "libsecret", "gpg", "env").
|
|
87
84
|
*/
|
|
88
85
|
export declare function getActiveVaultType(): VaultType;
|
|
86
|
+
/** Legacy module-level shim over the default client. */
|
|
87
|
+
export declare function isSessionValid(): boolean;
|
|
89
88
|
/**
|
|
90
89
|
* Store a credential in the active vault backend.
|
|
91
90
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAMrD;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,YAAY;IAQpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,QAAQ,CAAC,IAAI,cAAc;IAE3B;;;;OAIG;gBAC0B,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM;IAE7D,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAI1C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAItB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;CAGhC;AA6GD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED,wDAAwD;AACxD,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExE;AAuBD,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,8BAA8B;IAC9B,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,CAAC,CAiC5B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAG/E"}
|