@centient/secrets 0.2.0

package/dist/vault/vault-gpg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-gpg.js","sourceRoot":"","sources":["../../src/vault/vault-gpg.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAEtD,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,aAAa,EAAE,eAAe,CAAC,EAChC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,6EAA6E;gBAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;oBAAE,SAAS;gBAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACnB;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAEjC,aAAa,EAAE,CAAC;YAEhB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,YAAY,CACV,KAAK,EACL,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EACtD;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EACtC;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,MAAM,IAAI,IAAI,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qDAAqD;YACrD,IACE,GAAG,KAAK,IAAI;gBACZ,OAAO,GAAG,KAAK,QAAQ;gBACvB,MAAM,IAAI,GAAG;gBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/vault/vault-libsecret.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Auth Vault — Credential Storage (Linux libsecret via secret-tool)
+ *
+ * Provides secure storage for auth tokens on Linux systems using the
+ * GNOME libsecret service via the `secret-tool` CLI. Credentials are
+ * stored under a fixed service attribute (`centient`) and a per-key
+ * attribute (`key`).
+ *
+ * Error handling: all functions return null/false on failure — never throw.
+ */
+import type { VaultBackend } from "./types.js";
+/**
+ * Vault backend that uses the `secret-tool` CLI to interact with the
+ * system's libsecret / GNOME Keyring service on Linux.
+ *
+ * Usage:
+ *   if (LibsecretVault.detect()) {
+ *     const vault = new LibsecretVault();
+ *     vault.store("auth-token", token);
+ *   }
+ */
+export declare class LibsecretVault implements VaultBackend {
+    /**
+     * Returns true if `secret-tool` is available on this system.
+     * Uses `which secret-tool` — returns false if not found or command fails.
+     */
+    static detect(): boolean;
+    /**
+     * Store a credential value in the libsecret keyring.
+     *
+     * @param key   - Logical key name (e.g. 'auth-token', 'refresh-token')
+     * @param value - The credential value to store (passed via stdin)
+     * @returns true on success, false if the write fails
+     */
+    store(key: string, value: string): boolean;
+    /**
+     * Retrieve a credential value from the libsecret keyring.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns The stored value, or null if not found / lookup fails
+     */
+    retrieve(key: string): string | null;
+    /**
+     * Delete a credential from the libsecret keyring.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns true on success (including "already deleted"), false on unexpected error
+     */
+    delete(key: string): boolean;
+}
+//# sourceMappingURL=vault-libsecret.d.ts.map

package/dist/vault/vault-libsecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-libsecret.d.ts","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD;;;OAGG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAYxB;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAiB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAkB7B"}

package/dist/vault/vault-libsecret.js

@@ -0,0 +1,115 @@
+/**
+ * Auth Vault — Credential Storage (Linux libsecret via secret-tool)
+ *
+ * Provides secure storage for auth tokens on Linux systems using the
+ * GNOME libsecret service via the `secret-tool` CLI. Credentials are
+ * stored under a fixed service attribute (`centient`) and a per-key
+ * attribute (`key`).
+ *
+ * Error handling: all functions return null/false on failure — never throw.
+ */
+import { execSync } from "child_process";
+import { isValidKey } from "./vault-utils.js";
+// =============================================================================
+// Constants
+// =============================================================================
+const SERVICE_ATTR = "centient";
+const LABEL = "centient-auth";
+// =============================================================================
+// LibsecretVault
+// =============================================================================
+/**
+ * Vault backend that uses the `secret-tool` CLI to interact with the
+ * system's libsecret / GNOME Keyring service on Linux.
+ *
+ * Usage:
+ *   if (LibsecretVault.detect()) {
+ *     const vault = new LibsecretVault();
+ *     vault.store("auth-token", token);
+ *   }
+ */
+export class LibsecretVault {
+    /**
+     * Returns true if `secret-tool` is available on this system.
+     * Uses `which secret-tool` — returns false if not found or command fails.
+     */
+    static detect() {
+        try {
+            execSync("which secret-tool", {
+                encoding: "utf8",
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Store a credential value in the libsecret keyring.
+     *
+     * @param key   - Logical key name (e.g. 'auth-token', 'refresh-token')
+     * @param value - The credential value to store (passed via stdin)
+     * @returns true on success, false if the write fails
+     */
+    store(key, value) {
+        if (!isValidKey(key))
+            return false;
+        try {
+            execSync(`secret-tool store --label "${LABEL}" service ${SERVICE_ATTR} key "${key}"`, {
+                encoding: "utf8",
+                stdio: ["pipe", "pipe", "pipe"],
+                input: value,
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Retrieve a credential value from the libsecret keyring.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns The stored value, or null if not found / lookup fails
+     */
+    retrieve(key) {
+        if (!isValidKey(key))
+            return null;
+        try {
+            const result = execSync(`secret-tool lookup service ${SERVICE_ATTR} key "${key}"`, {
+                encoding: "utf8",
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            const trimmed = result.trim();
+            return trimmed.length > 0 ? trimmed : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Delete a credential from the libsecret keyring.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns true on success (including "already deleted"), false on unexpected error
+     */
+    delete(key) {
+        if (!isValidKey(key))
+            return false;
+        try {
+            execSync(`secret-tool clear service ${SERVICE_ATTR} key "${key}"`, {
+                encoding: "utf8",
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            return true;
+        }
+        catch {
+            // secret-tool clear exits 0 even if item does not exist;
+            // any non-zero exit indicates an unexpected error — still return true
+            // to match the "already deleted" semantic of other backends.
+            return true;
+        }
+    }
+}
+//# sourceMappingURL=vault-libsecret.js.map

package/dist/vault/vault-libsecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-libsecret.js","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,KAAK,GAAG,eAAe,CAAC;AAE9B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACzB;;;OAGG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,QAAQ,CAAC,mBAAmB,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,8BAA8B,KAAK,aAAa,YAAY,SAAS,GAAG,GAAG,EAC3E;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,KAAK;aACb,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CACrB,8BAA8B,YAAY,SAAS,GAAG,GAAG,EACzD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,6BAA6B,YAAY,SAAS,GAAG,GAAG,EACxD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/vault/vault-utils.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Auth Vault — Shared Utilities
+ *
+ * Shared validation and helper functions used across all vault backends.
+ */
+/**
+ * Returns true if the given credential key name is valid.
+ * Keys must match /^[a-z0-9][a-z0-9-]*[a-z0-9]$/ and be at most 64 characters.
+ * This enforces that keys cannot contain shell-special characters.
+ */
+export declare function isValidKey(key: string): boolean;
+//# sourceMappingURL=vault-utils.d.ts.map

package/dist/vault/vault-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-utils.d.ts","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C"}

package/dist/vault/vault-utils.js

@@ -0,0 +1,16 @@
+/**
+ * Auth Vault — Shared Utilities
+ *
+ * Shared validation and helper functions used across all vault backends.
+ */
+/** Allowed key name pattern — alphanumeric and hyphens only, 2-64 chars. */
+const VALID_KEY_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+/**
+ * Returns true if the given credential key name is valid.
+ * Keys must match /^[a-z0-9][a-z0-9-]*[a-z0-9]$/ and be at most 64 characters.
+ * This enforces that keys cannot contain shell-special characters.
+ */
+export function isValidKey(key) {
+    return VALID_KEY_RE.test(key) && key.length <= 64;
+}
+//# sourceMappingURL=vault-utils.js.map

package/dist/vault/vault-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-utils.js","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4EAA4E;AAC5E,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/vault/vault-windows.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Auth Vault — Windows Credential Manager Backend (WSL)
+ *
+ * Implements the VaultBackend interface using the Windows Runtime PasswordVault
+ * API accessed via powershell.exe. This backend is intended for use in WSL
+ * (Windows Subsystem for Linux) environments where powershell.exe is reachable
+ * from the Linux filesystem.
+ *
+ * Detection: checks for the WSL_DISTRO_NAME environment variable or the
+ * presence of "microsoft" (case-insensitive) in /proc/version.
+ *
+ * Storage: credentials are stored in the Windows Credential Manager under the
+ * resource name "centient", with the logical key as the username.
+ *
+ * Error handling: all methods return false/null on failure — never throw.
+ */
+import type { VaultBackend } from "./types.js";
+/**
+ * Vault backend that stores credentials in the Windows Credential Manager
+ * using the Windows Runtime PasswordVault API via powershell.exe.
+ *
+ * This backend is only available in WSL environments. Use `WindowsVault.detect()`
+ * before instantiating to verify availability.
+ *
+ * Usage:
+ *   if (WindowsVault.detect()) {
+ *     const vault = new WindowsVault();
+ *     vault.store("auth-token", token);
+ *   }
+ */
+export declare class WindowsVault implements VaultBackend {
+    /**
+     * Returns true if running inside a WSL environment where powershell.exe is
+     * accessible.
+     *
+     * Detection order:
+     *   1. WSL_DISTRO_NAME environment variable is set and non-empty
+     *   2. /proc/version contains "microsoft" (case-insensitive)
+     */
+    static detect(): boolean;
+    /**
+     * Verifies that powershell.exe is reachable on PATH.
+     */
+    private static isPowershellAvailable;
+    /**
+     * Stores a credential in the Windows Credential Manager PasswordVault.
+     *
+     * The credential is stored under the resource name "centient" with `key`
+     * as the username and `value` as the password.
+     *
+     * @param key   - Logical key name (e.g. 'auth-token', 'refresh-token')
+     * @param value - The credential value to store
+     * @returns true on success, false if storage fails
+     */
+    store(key: string, value: string): boolean;
+    /**
+     * Retrieves a credential from the Windows Credential Manager PasswordVault.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns The stored password, or null if not found / retrieval fails
+     */
+    retrieve(key: string): string | null;
+    /**
+     * Removes a credential from the Windows Credential Manager PasswordVault.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns true on success (including "not found"), false on unexpected error
+     */
+    delete(key: string): boolean;
+}
+//# sourceMappingURL=vault-windows.d.ts.map

package/dist/vault/vault-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-windows.d.ts","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA+C/C;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAa,YAAW,YAAY;IAC/C;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAoBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAmB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAqB7B"}

package/dist/vault/vault-windows.js

@@ -0,0 +1,186 @@
+/**
+ * Auth Vault — Windows Credential Manager Backend (WSL)
+ *
+ * Implements the VaultBackend interface using the Windows Runtime PasswordVault
+ * API accessed via powershell.exe. This backend is intended for use in WSL
+ * (Windows Subsystem for Linux) environments where powershell.exe is reachable
+ * from the Linux filesystem.
+ *
+ * Detection: checks for the WSL_DISTRO_NAME environment variable or the
+ * presence of "microsoft" (case-insensitive) in /proc/version.
+ *
+ * Storage: credentials are stored in the Windows Credential Manager under the
+ * resource name "centient", with the logical key as the username.
+ *
+ * Error handling: all methods return false/null on failure — never throw.
+ */
+import { spawnSync } from "child_process";
+import { readFileSync } from "fs";
+import { isValidKey } from "./vault-utils.js";
+// =============================================================================
+// Constants
+// =============================================================================
+/** Windows Credential Manager resource name used for all centient credentials. */
+const RESOURCE_NAME = "centient";
+// =============================================================================
+// PowerShell helpers
+// =============================================================================
+/**
+ * Escapes a string for safe embedding inside a PowerShell single-quoted string.
+ * Single quotes are doubled per PowerShell escaping rules.
+ */
+function escapePsValue(value) {
+    return value.replace(/'/g, "''");
+}
+/**
+ * Executes a PowerShell command via powershell.exe with no profile and
+ * non-interactive mode. Returns stdout trimmed, or null on error.
+ *
+ * Uses spawnSync to bypass the shell entirely, preventing shell injection
+ * via credential values that contain double-quotes or shell metacharacters.
+ */
+function runPowershell(command) {
+    try {
+        const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8" });
+        if (result.error || result.status !== 0)
+            return null;
+        return result.stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+// =============================================================================
+// WindowsVault
+// =============================================================================
+/**
+ * Vault backend that stores credentials in the Windows Credential Manager
+ * using the Windows Runtime PasswordVault API via powershell.exe.
+ *
+ * This backend is only available in WSL environments. Use `WindowsVault.detect()`
+ * before instantiating to verify availability.
+ *
+ * Usage:
+ *   if (WindowsVault.detect()) {
+ *     const vault = new WindowsVault();
+ *     vault.store("auth-token", token);
+ *   }
+ */
+export class WindowsVault {
+    /**
+     * Returns true if running inside a WSL environment where powershell.exe is
+     * accessible.
+     *
+     * Detection order:
+     *   1. WSL_DISTRO_NAME environment variable is set and non-empty
+     *   2. /proc/version contains "microsoft" (case-insensitive)
+     */
+    static detect() {
+        // Primary detection: WSL_DISTRO_NAME env var
+        const wslDistro = process.env["WSL_DISTRO_NAME"];
+        if (wslDistro !== undefined && wslDistro.length > 0) {
+            return WindowsVault.isPowershellAvailable();
+        }
+        // Secondary detection: /proc/version content
+        try {
+            const procVersion = readFileSync("/proc/version", "utf8");
+            if (/microsoft/i.test(procVersion)) {
+                return WindowsVault.isPowershellAvailable();
+            }
+        }
+        catch {
+            // /proc/version not readable — not a Linux/WSL environment
+        }
+        return false;
+    }
+    /**
+     * Verifies that powershell.exe is reachable on PATH.
+     */
+    static isPowershellAvailable() {
+        try {
+            const result = spawnSync("which", ["powershell.exe"], {
+                encoding: "utf8",
+            });
+            return result.status === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Stores a credential in the Windows Credential Manager PasswordVault.
+     *
+     * The credential is stored under the resource name "centient" with `key`
+     * as the username and `value` as the password.
+     *
+     * @param key   - Logical key name (e.g. 'auth-token', 'refresh-token')
+     * @param value - The credential value to store
+     * @returns true on success, false if storage fails
+     */
+    store(key, value) {
+        if (!isValidKey(key))
+            return false;
+        const escapedKey = escapePsValue(key);
+        const escapedValue = escapePsValue(value);
+        const command = [
+            "& {",
+            "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];",
+            "$vault = New-Object Windows.Security.Credentials.PasswordVault;",
+            `$cred = New-Object Windows.Security.Credentials.PasswordCredential('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}', '${escapedValue}');`,
+            "$vault.Add($cred)",
+            "}",
+        ].join(" ");
+        const result = runPowershell(command);
+        return result !== null;
+    }
+    /**
+     * Retrieves a credential from the Windows Credential Manager PasswordVault.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns The stored password, or null if not found / retrieval fails
+     */
+    retrieve(key) {
+        if (!isValidKey(key))
+            return null;
+        const escapedKey = escapePsValue(key);
+        const command = [
+            "& {",
+            "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];",
+            "$vault = New-Object Windows.Security.Credentials.PasswordVault;",
+            `$cred = $vault.Retrieve('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}');`,
+            "$cred.RetrievePassword();",
+            "$cred.Password",
+            "}",
+        ].join(" ");
+        const result = runPowershell(command);
+        if (result === null || result.length === 0)
+            return null;
+        return result;
+    }
+    /**
+     * Removes a credential from the Windows Credential Manager PasswordVault.
+     *
+     * @param key - Logical key name (e.g. 'auth-token')
+     * @returns true on success (including "not found"), false on unexpected error
+     */
+    delete(key) {
+        if (!isValidKey(key))
+            return false;
+        const escapedKey = escapePsValue(key);
+        const command = [
+            "& {",
+            "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];",
+            "$vault = New-Object Windows.Security.Credentials.PasswordVault;",
+            "try {",
+            `$cred = $vault.Retrieve('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}');`,
+            "$vault.Remove($cred)",
+            "} catch {}",
+            "}",
+        ].join(" ");
+        // A null result from runPowershell means powershell.exe itself failed to
+        // execute; swallowing "not found" errors is handled inside the PS try/catch.
+        const result = runPowershell(command);
+        return result !== null;
+    }
+}
+//# sourceMappingURL=vault-windows.js.map

package/dist/vault/vault-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAQ,MAAM,CAAC,MAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,6CAA6C;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;gBACpD,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,uEAAuE,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,OAAO,YAAY,KAAK;YAC5I,mBAAmB;YACnB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,2BAA2B;YAC3B,gBAAgB;YAChB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,sBAAsB;YACtB,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/vault/vault.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Auth Vault — Credential Storage (Cascade: Keychain -> Windows -> Libsecret -> GPG -> Env)
+ *
+ * Provides secure storage for auth tokens using a cascade of backends:
+ *   1. KeychainVault  — macOS Keychain via `security` CLI (macOS only)
+ *   2. WindowsVault   — Windows Credential Manager via powershell.exe (WSL)
+ *   3. LibsecretVault — GNOME libsecret via `secret-tool` (Linux)
+ *   4. GpgVault       — GPG-encrypted files (Linux / WSL)
+ *   5. EnvVault       — Environment variable fallback (always available)
+ *
+ * The active backend is selected once at module load by calling each backend's
+ * static `detect()` method in order and choosing the first one that returns true.
+ *
+ * Session TTL: 4 hours from the last successful read/write.
+ *
+ * Error handling: all functions return null/false on failure — never throw.
+ */
+import type { VaultType } from "./types.js";
+/**
+ * Returns true if the in-process session is still within the TTL window.
+ * This does NOT validate the token itself — use validateToken() for that.
+ */
+export declare function isSessionValid(): boolean;
+/**
+ * Returns the type identifier for the active vault backend.
+ *
+ * Useful for diagnostics and health checks to know which backend was selected
+ * at startup (e.g. "keychain", "libsecret", "gpg", "env").
+ */
+export declare function getActiveVaultType(): VaultType;
+/**
+ * Store a credential in the active vault backend.
+ *
+ * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token')
+ * @param value   - The credential value to store
+ * @returns true on success, false if the backend write fails
+ */
+export declare function storeCredential(key: string, value: string): Promise<boolean>;
+/**
+ * Retrieve a credential from the active vault backend.
+ *
+ * @param key - Logical key name (e.g. 'auth-token')
+ * @returns The stored value, or null if not found / backend unavailable
+ */
+export declare function getCredential(key: string): Promise<string | null>;
+/**
+ * Delete a credential from the active vault backend.
+ *
+ * @param key - Logical key name (e.g. 'auth-token')
+ * @returns true on success (including "already deleted"), false on unexpected error
+ */
+export declare function deleteCredential(key: string): Promise<boolean>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/vault/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,YAAY,CAAC;AA4D1D;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAWD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpE"}