@centient/secrets 0.4.0 → 0.6.0

package/README.md

@@ -2,6 +2,8 @@
 
 Cross-platform secrets vault with AES-256-GCM encryption and platform-native key storage.
 
+> **Daemons / long-running processes:** see [Session-backed vault (`openVault`)](./docs/session-vault.md) for the recommended API — single master-key unlock per session, in-memory cached reads, mtime-check coherence with the CLI, rollback protection via monotonic version + sidecar.
+
 ## Installation
 
 ```bash

package/dist/cli/hidden-input.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Hidden-Input State Machine
+ *
+ * Pure character-stream parser used by the secrets CLI's hidden-input prompt
+ * (password / secret entry). Extracted from `secrets-cli.ts` so the parsing
+ * rules can be exercised directly in tests without stubbing `process.stdin`.
+ *
+ * Regression: issue #37 — the previous prompt resolved on the first `\n`
+ * from a terminal paste and silently truncated multi-line secrets (PEM keys,
+ * multi-line config blobs) to their first line.
+ */
+/** VT100 bracketed-paste sentinels — wraps pasted content from the terminal. */
+export declare const PASTE_START = "\u001B[200~";
+export declare const PASTE_END = "\u001B[201~";
+/** Enable / disable bracketed paste mode on the current terminal. */
+export declare const ENABLE_BRACKETED_PASTE = "\u001B[?2004h";
+export declare const DISABLE_BRACKETED_PASTE = "\u001B[?2004l";
+/** Control characters recognized by the hidden-input state machine. */
+export declare const CTRL_C = "\u0003";
+export declare const CTRL_D = "\u0004";
+export declare const BACKSPACE = "";
+export declare const BS = "\b";
+/** Signal emitted by {@link advanceHiddenInput} to indicate why input stopped. */
+export type HiddenInputSignal = "submit" | "ctrl-c" | "continue";
+/**
+ * Mutable state for the hidden-input parser. Callers should construct a fresh
+ * instance per prompt and feed chunks via {@link advanceHiddenInput}.
+ */
+export interface HiddenInputState {
+    input: string;
+    inPaste: boolean;
+    escBuf: string;
+    /**
+     * True when the state machine has recognized an escape sequence that is not
+     * a paste-marker prefix and is swallowing characters until the sequence's
+     * terminator byte arrives. Prevents stray `~` / digits from unrelated CSI
+     * sequences (e.g. Delete `\x1b[3~`, arrow keys) from leaking into `input`.
+     */
+    swallowingCsi: boolean;
+}
+export declare function createHiddenInputState(): HiddenInputState;
+/**
+ * Advance the state machine with a single chunk from stdin. Returns `"submit"`
+ * when the caller should resolve the prompt with `state.input`, `"ctrl-c"`
+ * when the user interrupted, or `"continue"` when more input is expected.
+ *
+ * Character-by-character processing ensures escape-sequence state survives
+ * across chunk boundaries (a fast paste may arrive split across many chunks,
+ * and a single chunk may contain both paste markers and regular keystrokes).
+ */
+export declare function advanceHiddenInput(state: HiddenInputState, chunk: string): HiddenInputSignal;
+//# sourceMappingURL=hidden-input.d.ts.map

package/dist/cli/hidden-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hidden-input.d.ts","sourceRoot":"","sources":["../../src/cli/hidden-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,gFAAgF;AAChF,eAAO,MAAM,WAAW,gBAAc,CAAC;AACvC,eAAO,MAAM,SAAS,gBAAc,CAAC;AACrC,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,kBAAgB,CAAC;AACpD,eAAO,MAAM,uBAAuB,kBAAgB,CAAC;AAErD,uEAAuE;AACvE,eAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,eAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,eAAO,MAAM,SAAS,MAAW,CAAC;AAClC,eAAO,MAAM,EAAE,OAAO,CAAC;AAEvB,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAeD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,GACZ,iBAAiB,CAmEnB"}

package/dist/cli/hidden-input.js

@@ -0,0 +1,109 @@
+/**
+ * Hidden-Input State Machine
+ *
+ * Pure character-stream parser used by the secrets CLI's hidden-input prompt
+ * (password / secret entry). Extracted from `secrets-cli.ts` so the parsing
+ * rules can be exercised directly in tests without stubbing `process.stdin`.
+ *
+ * Regression: issue #37 — the previous prompt resolved on the first `\n`
+ * from a terminal paste and silently truncated multi-line secrets (PEM keys,
+ * multi-line config blobs) to their first line.
+ */
+/** VT100 bracketed-paste sentinels — wraps pasted content from the terminal. */
+export const PASTE_START = "\x1b[200~";
+export const PASTE_END = "\x1b[201~";
+/** Enable / disable bracketed paste mode on the current terminal. */
+export const ENABLE_BRACKETED_PASTE = "\x1b[?2004h";
+export const DISABLE_BRACKETED_PASTE = "\x1b[?2004l";
+/** Control characters recognized by the hidden-input state machine. */
+export const CTRL_C = "\u0003";
+export const CTRL_D = "\u0004";
+export const BACKSPACE = "\u007F";
+export const BS = "\b";
+export function createHiddenInputState() {
+    return { input: "", inPaste: false, escBuf: "", swallowingCsi: false };
+}
+/**
+ * CSI final-byte range per ECMA-48: `\x40`-`\x7E` (i.e. `@` through `~`). When
+ * we're swallowing a CSI we know isn't a paste marker, we stop at the first
+ * byte in this range that isn't a parameter byte (`0`-`9`, `;`, `:`, `<`-`?`).
+ */
+function isCsiTerminator(char) {
+    const code = char.charCodeAt(0);
+    // Parameter / intermediate bytes — not terminators.
+    if ((code >= 0x30 && code <= 0x3f) || (code >= 0x20 && code <= 0x2f))
+        return false;
+    // Final byte range.
+    return code >= 0x40 && code <= 0x7e;
+}
+/**
+ * Advance the state machine with a single chunk from stdin. Returns `"submit"`
+ * when the caller should resolve the prompt with `state.input`, `"ctrl-c"`
+ * when the user interrupted, or `"continue"` when more input is expected.
+ *
+ * Character-by-character processing ensures escape-sequence state survives
+ * across chunk boundaries (a fast paste may arrive split across many chunks,
+ * and a single chunk may contain both paste markers and regular keystrokes).
+ */
+export function advanceHiddenInput(state, chunk) {
+    for (let i = 0; i < chunk.length; i++) {
+        const char = chunk[i];
+        // Swallowing a non-paste CSI sequence: drop characters until the CSI
+        // terminator byte arrives, then resume normal processing.
+        if (state.swallowingCsi) {
+            if (isCsiTerminator(char))
+                state.swallowingCsi = false;
+            continue;
+        }
+        // Accumulate potential bracketed-paste marker.
+        if (state.escBuf || char === "\x1b") {
+            state.escBuf += char;
+            if (state.escBuf === PASTE_START) {
+                state.inPaste = true;
+                state.escBuf = "";
+                continue;
+            }
+            if (state.escBuf === PASTE_END) {
+                state.inPaste = false;
+                state.escBuf = "";
+                continue;
+            }
+            // If escBuf is no longer a prefix of either paste marker, it's a
+            // different escape sequence (arrow keys, Delete, F-keys, etc.). Switch
+            // to swallow-until-terminator mode so we don't leak the sequence's
+            // final byte (e.g. `~` from `\x1b[3~`) into the input buffer.
+            if (!PASTE_START.startsWith(state.escBuf) &&
+                !PASTE_END.startsWith(state.escBuf)) {
+                // If the current char is already a terminator, we've consumed the
+                // entire sequence; no need to swallow more.
+                state.swallowingCsi = !isCsiTerminator(char);
+                state.escBuf = "";
+            }
+            continue;
+        }
+        // Inside a bracketed paste, newlines are literal content.
+        if (state.inPaste) {
+            state.input += char;
+            continue;
+        }
+        if (char === CTRL_C)
+            return "ctrl-c";
+        if (char === CTRL_D) {
+            // Explicit end-of-input (multi-line escape hatch for terminals without
+            // bracketed-paste support).
+            return "submit";
+        }
+        if (char === "\n" || char === "\r") {
+            // Single-line submit — preserves the old single-password UX.
+            return "submit";
+        }
+        if (char === BACKSPACE || char === BS) {
+            if (state.input.length > 0)
+                state.input = state.input.slice(0, -1);
+            continue;
+        }
+        state.input += char;
+    }
+    return "continue";
+}
+//# sourceMappingURL=hidden-input.js.map

package/dist/cli/hidden-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hidden-input.js","sourceRoot":"","sources":["../../src/cli/hidden-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,uEAAuE;AACvE,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAC/B,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAC/B,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC;AAClC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;AAsBvB,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,oDAAoD;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,oBAAoB;IACpB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAuB,EACvB,KAAa;IAEb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAEvB,qEAAqE;QACrE,0DAA0D;QAC1D,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,eAAe,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC;YACvD,SAAS;QACX,CAAC;QAED,+CAA+C;QAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACjC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gBACrB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;gBACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,iEAAiE;YACjE,uEAAuE;YACvE,mEAAmE;YACnE,8DAA8D;YAC9D,IACE,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrC,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EACnC,CAAC;gBACD,kEAAkE;gBAClE,4CAA4C;gBAC5C,KAAK,CAAC,aAAa,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC7C,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpB,CAAC;YACD,SAAS;QACX,CAAC;QAED,0DAA0D;QAC1D,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QAErC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,uEAAuE;YACvE,4BAA4B;YAC5B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,6DAA6D;YAC7D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QAED,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/cli/secrets-cli.d.ts

@@ -27,6 +27,13 @@
  *   - Vault is encrypted with AES-256-GCM
  *   - Key stored via pluggable provider (macOS Keychain or 1Password)
  *   - 4-hour session timeout
+ *
+ * Internals:
+ *   Vault mutations flow through `openVault` (session-vault.ts) so the CLI
+ *   and the library-facing API share one on-disk format (AAD-bound, schema 1).
+ *   Pre-`openVault` CLI-written vaults (AAD-less, legacy flat format) are
+ *   handled transparently by session-vault's legacy-read path and upgraded to
+ *   schema 1 on the next successful write.
  */
 export interface SecretsOptions {
     command: "init" | "unlock" | "lock" | "list" | "list-backend-keys" | "set" | "get" | "delete" | "status" | "migrate" | "env-list" | "env-switch" | "env-create" | "env-current";
@@ -34,6 +41,8 @@ export interface SecretsOptions {
     secretValue?: string;
     /** Optional prefix filter for `list-backend-keys`. */
     prefix?: string;
+    /** Output JSON instead of human-readable text (`list-backend-keys --json`). */
+    json?: boolean;
 }
 /**
  * Run secrets command

package/dist/cli/secrets-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-cli.d.ts","sourceRoot":"","sources":["../../src/cli/secrets-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,MAAM,WAAW,cAAc;IAC7B,OAAO,EACH,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,mBAAmB,GACnB,KAAK,GACL,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,aAAa,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoqBD;;GAEG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDvE"}
+{"version":3,"file":"secrets-cli.d.ts","sourceRoot":"","sources":["../../src/cli/secrets-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAkBH,MAAM,WAAW,cAAc;IAC7B,OAAO,EACH,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,mBAAmB,GACnB,KAAK,GACL,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,aAAa,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAovBD;;GAEG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDvE"}