@centient/secrets 0.2.0

package/dist/cli/messages.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Auth Module - Centralized Message Strings
+ *
+ * All user-visible strings for the auth module are defined here.
+ * This module is i18n-ready: message values do not contain interpolated
+ * strings — template functions accept parameters and return formatted strings.
+ *
+ * Usage:
+ *   import { AUTH_MESSAGES } from './messages.js';
+ *   process.stderr.write(AUTH_MESSAGES.error.vaultWriteFailed + '\n');
+ *   process.stderr.write(AUTH_MESSAGES.info.loginPrompt('https://auth.example.com') + '\n');
+ */
+export declare const AUTH_MESSAGES: {
+    readonly success: {
+        readonly loggedIn: "Authentication successful. You are now logged in.";
+        readonly loggedOut: "Logged out successfully. Credentials removed.";
+        readonly tokenStored: "Token stored securely in vault.";
+        readonly tokenRefreshed: "Token refreshed successfully.";
+        readonly apiKeyStored: "API key stored securely in vault.";
+        readonly revokeComplete: "Token revoked on server.";
+    };
+    readonly error: {
+        readonly vaultWriteFailed: "Failed to write credentials to vault.";
+        readonly vaultReadFailed: "Failed to read credentials from vault.";
+        readonly vaultDeleteFailed: "Failed to delete credentials from vault.";
+        readonly deviceFlowFailed: "Device authorization flow failed.";
+        readonly deviceFlowTimeout: "Device authorization timed out. Please try again.";
+        readonly deviceFlowAccessDenied: "Access denied. Authorization was rejected.";
+        readonly deviceFlowExpired: "Device code expired. Please run login again.";
+        readonly tokenExpired: "Your session has expired. Please run `centient login`.";
+        readonly tokenInvalid: "Invalid token format.";
+        readonly tokenMalformed: "Could not decode token — unexpected format.";
+        readonly networkError: "Network error during authentication.";
+        readonly refreshFailed: "Token refresh failed. Please run `centient login` again.";
+        readonly revokeFailed: "Token revocation failed (server may be unreachable).";
+        readonly apiKeyInvalidFormat: (key: string) => string;
+        readonly agentEnvironmentBlocked: "This command is not available in agent environments.";
+        readonly unknownSubcommand: (cmd: string) => string;
+    };
+    readonly warning: {
+        readonly tokenExpiringSoon: (minutes: number) => string;
+        readonly revokeNetworkFailure: "Could not reach server to revoke token — local credentials have been removed.";
+        readonly noCredentialsFound: "No stored credentials found. Run `centient login` to authenticate.";
+        readonly sessionExpiredIdle: "Session expired due to inactivity.";
+        readonly envVaultNoStorage: "No secure credential storage available. Install libsecret (Linux: apt install libsecret-tools) or GPG for persistent storage. Using ENGRAM_API_KEY environment variable only.";
+    };
+    readonly info: {
+        readonly loginPrompt: (verificationUri: string) => string;
+        readonly userCodeDisplay: (userCode: string) => string;
+        readonly pollingWait: (seconds: number) => string;
+        readonly loginRecoveryHint: "If login fails, set ENGRAM_API_KEY in your environment for headless/CI usage.";
+        readonly authStatusAuthenticated: (expiresIn: string) => string;
+        readonly authStatusUnauthenticated: "Not authenticated. Run `centient login`.";
+        readonly authStatusExpiringSoon: (minutes: number) => string;
+        readonly vaultType: (vaultType: string) => string;
+        readonly logoutStarting: "Logging out...";
+        readonly loginStarting: "Starting device authorization flow...";
+    };
+};
+//# sourceMappingURL=messages.d.ts.map

package/dist/cli/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/cli/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;4CAwBK,MAAM,KAAG,MAAM;;0CAIjB,MAAM,KAAG,MAAM;;;8CAKX,MAAM,KAAG,MAAM;;;;;;;gDAYb,MAAM,KAAG,MAAM;6CAElB,MAAM,KAAG,MAAM;wCAEpB,MAAM,KAAG,MAAM;;sDAID,MAAM,KAAG,MAAM;;mDAGlB,MAAM,KAAG,MAAM;wCAE1B,MAAM,KAAG,MAAM;;;;CAIhC,CAAC"}

package/dist/cli/messages.js

@@ -0,0 +1,63 @@
+/**
+ * Auth Module - Centralized Message Strings
+ *
+ * All user-visible strings for the auth module are defined here.
+ * This module is i18n-ready: message values do not contain interpolated
+ * strings — template functions accept parameters and return formatted strings.
+ *
+ * Usage:
+ *   import { AUTH_MESSAGES } from './messages.js';
+ *   process.stderr.write(AUTH_MESSAGES.error.vaultWriteFailed + '\n');
+ *   process.stderr.write(AUTH_MESSAGES.info.loginPrompt('https://auth.example.com') + '\n');
+ */
+// =============================================================================
+// Message catalog
+// =============================================================================
+export const AUTH_MESSAGES = {
+    success: {
+        loggedIn: "Authentication successful. You are now logged in.",
+        loggedOut: "Logged out successfully. Credentials removed.",
+        tokenStored: "Token stored securely in vault.",
+        tokenRefreshed: "Token refreshed successfully.",
+        apiKeyStored: "API key stored securely in vault.",
+        revokeComplete: "Token revoked on server.",
+    },
+    error: {
+        vaultWriteFailed: "Failed to write credentials to vault.",
+        vaultReadFailed: "Failed to read credentials from vault.",
+        vaultDeleteFailed: "Failed to delete credentials from vault.",
+        deviceFlowFailed: "Device authorization flow failed.",
+        deviceFlowTimeout: "Device authorization timed out. Please try again.",
+        deviceFlowAccessDenied: "Access denied. Authorization was rejected.",
+        deviceFlowExpired: "Device code expired. Please run login again.",
+        tokenExpired: "Your session has expired. Please run `centient login`.",
+        tokenInvalid: "Invalid token format.",
+        tokenMalformed: "Could not decode token — unexpected format.",
+        networkError: "Network error during authentication.",
+        refreshFailed: "Token refresh failed. Please run `centient login` again.",
+        revokeFailed: "Token revocation failed (server may be unreachable).",
+        apiKeyInvalidFormat: (key) => `Invalid API key format: '${key}'. API keys must start with 'eng_'.`,
+        agentEnvironmentBlocked: "This command is not available in agent environments.",
+        unknownSubcommand: (cmd) => `Unknown subcommand: '${cmd}'. Run \`centient auth --help\` for usage.`,
+    },
+    warning: {
+        tokenExpiringSoon: (minutes) => `Your token expires in ${minutes} minute${minutes === 1 ? "" : "s"}. Run \`centient login\` to refresh.`,
+        revokeNetworkFailure: "Could not reach server to revoke token — local credentials have been removed.",
+        noCredentialsFound: "No stored credentials found. Run `centient login` to authenticate.",
+        sessionExpiredIdle: "Session expired due to inactivity.",
+        envVaultNoStorage: "No secure credential storage available. Install libsecret (Linux: apt install libsecret-tools) or GPG for persistent storage. Using ENGRAM_API_KEY environment variable only.",
+    },
+    info: {
+        loginPrompt: (verificationUri) => `Visit the following URL to authorize this device:\n  ${verificationUri}`,
+        userCodeDisplay: (userCode) => `Enter this code when prompted:\n  ${userCode}`,
+        pollingWait: (seconds) => `Waiting for authorization... (${seconds}s remaining)`,
+        loginRecoveryHint: "If login fails, set ENGRAM_API_KEY in your environment for headless/CI usage.",
+        authStatusAuthenticated: (expiresIn) => `Authenticated. Token expires in ${expiresIn}.`,
+        authStatusUnauthenticated: "Not authenticated. Run `centient login`.",
+        authStatusExpiringSoon: (minutes) => `Authenticated (expiring in ${minutes} minute${minutes === 1 ? "" : "s"}).`,
+        vaultType: (vaultType) => `Vault: ${vaultType}`,
+        logoutStarting: "Logging out...",
+        loginStarting: "Starting device authorization flow...",
+    },
+};
+//# sourceMappingURL=messages.js.map

package/dist/cli/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/cli/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE;QACP,QAAQ,EAAE,mDAAmD;QAC7D,SAAS,EAAE,+CAA+C;QAC1D,WAAW,EAAE,iCAAiC;QAC9C,cAAc,EAAE,+BAA+B;QAC/C,YAAY,EAAE,mCAAmC;QACjD,cAAc,EAAE,0BAA0B;KAC3C;IAED,KAAK,EAAE;QACL,gBAAgB,EAAE,uCAAuC;QACzD,eAAe,EAAE,wCAAwC;QACzD,iBAAiB,EAAE,0CAA0C;QAC7D,gBAAgB,EAAE,mCAAmC;QACrD,iBAAiB,EAAE,mDAAmD;QACtE,sBAAsB,EAAE,4CAA4C;QACpE,iBAAiB,EAAE,8CAA8C;QACjE,YAAY,EAAE,wDAAwD;QACtE,YAAY,EAAE,uBAAuB;QACrC,cAAc,EAAE,6CAA6C;QAC7D,YAAY,EAAE,sCAAsC;QACpD,aAAa,EAAE,0DAA0D;QACzE,YAAY,EAAE,sDAAsD;QACpE,mBAAmB,EAAE,CAAC,GAAW,EAAU,EAAE,CAC3C,4BAA4B,GAAG,qCAAqC;QACtE,uBAAuB,EACrB,sDAAsD;QACxD,iBAAiB,EAAE,CAAC,GAAW,EAAU,EAAE,CACzC,wBAAwB,GAAG,4CAA4C;KAC1E;IAED,OAAO,EAAE;QACP,iBAAiB,EAAE,CAAC,OAAe,EAAU,EAAE,CAC7C,yBAAyB,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,sCAAsC;QAC1G,oBAAoB,EAClB,+EAA+E;QACjF,kBAAkB,EAChB,oEAAoE;QACtE,kBAAkB,EAAE,oCAAoC;QACxD,iBAAiB,EACf,+KAA+K;KAClL;IAED,IAAI,EAAE;QACJ,WAAW,EAAE,CAAC,eAAuB,EAAU,EAAE,CAC/C,wDAAwD,eAAe,EAAE;QAC3E,eAAe,EAAE,CAAC,QAAgB,EAAU,EAAE,CAC5C,qCAAqC,QAAQ,EAAE;QACjD,WAAW,EAAE,CAAC,OAAe,EAAU,EAAE,CACvC,iCAAiC,OAAO,cAAc;QACxD,iBAAiB,EACf,+EAA+E;QACjF,uBAAuB,EAAE,CAAC,SAAiB,EAAU,EAAE,CACrD,mCAAmC,SAAS,GAAG;QACjD,yBAAyB,EAAE,0CAA0C;QACrE,sBAAsB,EAAE,CAAC,OAAe,EAAU,EAAE,CAClD,8BAA8B,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QAC7E,SAAS,EAAE,CAAC,SAAiB,EAAU,EAAE,CAAC,UAAU,SAAS,EAAE;QAC/D,cAAc,EAAE,gBAAgB;QAChC,aAAa,EAAE,uCAAuC;KACvD;CACO,CAAC"}

package/dist/cli/secrets-cli.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Secrets CLI Commands
+ *
+ * CLI commands for managing the encrypted secrets vault and environments.
+ * These commands are only available to human operators (blocked from AI agents).
+ *
+ * Vault Commands:
+ *   centient secrets init              Initialize a new encrypted vault
+ *   centient secrets unlock            Unlock the vault (prompts biometric)
+ *   centient secrets lock              Lock the vault
+ *   centient secrets list              List secret names (not values)
+ *   centient secrets set <name>        Add/update a secret (prompts for value)
+ *   centient secrets get <name>        Get a secret value
+ *   centient secrets delete <name>     Delete a secret
+ *   centient secrets status            Show vault status
+ *
+ * Environment Commands:
+ *   centient secrets env-list          List all environments
+ *   centient secrets env-switch <name> Switch to an environment
+ *   centient secrets env-create <name> Create a new environment
+ *   centient secrets env-current       Show current environment
+ *
+ * Security:
+ *   - All commands check for AI agent environment and refuse to run
+ *   - Vault is encrypted with AES-256-GCM
+ *   - Key stored in macOS Keychain (requires biometric/PIN)
+ *   - 4-hour session timeout, 30-minute idle timeout
+ */
+export interface SecretsOptions {
+    command: "init" | "unlock" | "lock" | "list" | "set" | "get" | "delete" | "status" | "env-list" | "env-switch" | "env-create" | "env-current";
+    secretName?: string;
+    secretValue?: string;
+}
+/**
+ * Run secrets command
+ */
+export declare function runSecrets(options: SecretsOptions): Promise<void>;
+//# sourceMappingURL=secrets-cli.d.ts.map

package/dist/cli/secrets-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-cli.d.ts","sourceRoot":"","sources":["../../src/cli/secrets-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAWH,MAAM,WAAW,cAAc;IAC7B,OAAO,EACH,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,aAAa,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyhBD;;GAEG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDvE"}