@centient/secrets 0.2.0

package/dist/vault/vault.js

@@ -0,0 +1,132 @@
+/**
+ * Auth Vault — Credential Storage (Cascade: Keychain -> Windows -> Libsecret -> GPG -> Env)
+ *
+ * Provides secure storage for auth tokens using a cascade of backends:
+ *   1. KeychainVault  — macOS Keychain via `security` CLI (macOS only)
+ *   2. WindowsVault   — Windows Credential Manager via powershell.exe (WSL)
+ *   3. LibsecretVault — GNOME libsecret via `secret-tool` (Linux)
+ *   4. GpgVault       — GPG-encrypted files (Linux / WSL)
+ *   5. EnvVault       — Environment variable fallback (always available)
+ *
+ * The active backend is selected once at module load by calling each backend's
+ * static `detect()` method in order and choosing the first one that returns true.
+ *
+ * Session TTL: 4 hours from the last successful read/write.
+ *
+ * Error handling: all functions return null/false on failure — never throw.
+ */
+import { storeStringInKeychain, getStringFromKeychain, deleteFromKeychain, } from "../crypto/vault-common.js";
+import { WindowsVault } from "./vault-windows.js";
+import { LibsecretVault } from "./vault-libsecret.js";
+import { GpgVault } from "./vault-gpg.js";
+import { EnvVault } from "./vault-env.js";
+// =============================================================================
+// Constants
+// =============================================================================
+const AUTH_KEYCHAIN_SERVICE = "centient-auth";
+const SESSION_TTL_MS = 4 * 60 * 60 * 1000; // 4 hours
+// =============================================================================
+// KeychainVault wrapper
+// =============================================================================
+/**
+ * Wraps the existing macOS Keychain helper functions as a VaultBackend.
+ * Only available on macOS (darwin).
+ */
+class KeychainVault {
+    static detect() {
+        return process.platform === "darwin";
+    }
+    store(key, value) {
+        return storeStringInKeychain(AUTH_KEYCHAIN_SERVICE, key, value);
+    }
+    retrieve(key) {
+        return getStringFromKeychain(AUTH_KEYCHAIN_SERVICE, key);
+    }
+    delete(key) {
+        return deleteFromKeychain(AUTH_KEYCHAIN_SERVICE, key);
+    }
+}
+// =============================================================================
+// Cascade initialization
+// =============================================================================
+/**
+ * Selects the first available vault backend in priority order:
+ *   Keychain -> Windows -> Libsecret -> GPG -> Env
+ */
+function initVaultBackend() {
+    if (KeychainVault.detect())
+        return { backend: new KeychainVault(), type: "keychain" };
+    if (WindowsVault.detect())
+        return { backend: new WindowsVault(), type: "windows" };
+    if (LibsecretVault.detect())
+        return { backend: new LibsecretVault(), type: "libsecret" };
+    if (GpgVault.detect())
+        return { backend: new GpgVault(), type: "gpg" };
+    return { backend: new EnvVault(), type: "env" };
+}
+const { backend: activeBackend, type: activeVaultType } = initVaultBackend();
+// =============================================================================
+// Session State
+// =============================================================================
+/** Last successful vault access timestamp (epoch ms). */
+let lastAccessAt = null;
+/**
+ * Returns true if the in-process session is still within the TTL window.
+ * This does NOT validate the token itself — use validateToken() for that.
+ */
+export function isSessionValid() {
+    if (lastAccessAt === null)
+        return false;
+    return Date.now() - lastAccessAt < SESSION_TTL_MS;
+}
+/** Update session timestamp on successful access. */
+function touchSession() {
+    lastAccessAt = Date.now();
+}
+// =============================================================================
+// Public API
+// =============================================================================
+/**
+ * Returns the type identifier for the active vault backend.
+ *
+ * Useful for diagnostics and health checks to know which backend was selected
+ * at startup (e.g. "keychain", "libsecret", "gpg", "env").
+ */
+export function getActiveVaultType() {
+    return activeVaultType;
+}
+/**
+ * Store a credential in the active vault backend.
+ *
+ * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token')
+ * @param value   - The credential value to store
+ * @returns true on success, false if the backend write fails
+ */
+export async function storeCredential(key, value) {
+    const success = activeBackend.store(key, value);
+    if (success)
+        touchSession();
+    return success;
+}
+/**
+ * Retrieve a credential from the active vault backend.
+ *
+ * @param key - Logical key name (e.g. 'auth-token')
+ * @returns The stored value, or null if not found / backend unavailable
+ */
+export async function getCredential(key) {
+    const value = activeBackend.retrieve(key);
+    if (value !== null)
+        touchSession();
+    return value;
+}
+/**
+ * Delete a credential from the active vault backend.
+ *
+ * @param key - Logical key name (e.g. 'auth-token')
+ * @returns true on success (including "already deleted"), false on unexpected error
+ */
+export async function deleteCredential(key) {
+    return activeBackend.delete(key);
+}
+//# sourceMappingURL=vault.js.map

package/dist/vault/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,aAAa;IACjB,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,OAAO,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@centient/secrets",
+  "version": "0.2.0",
+  "description": "Cross-platform secrets vault with AES-256-GCM encryption and platform-native key storage",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.3.0",
+    "vitest": "^4.0.17"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "license": "MIT"
+}