@compass-ai/nova 1.0.73 → 1.0.74

package/dist/services/credential-store.d.ts

@@ -0,0 +1,273 @@
+/**
+ * Credential storage service using keytar for system keychain integration
+ * with AES-256 encrypted file fallback for API keys.
+ *
+ * This module provides secure storage for sensitive credentials like API keys,
+ * using the system keychain when available (via keytar) and falling back to
+ * AES-256 encrypted file storage when the keychain is unavailable.
+ *
+ * Security features:
+ * - System keychain integration via keytar (macOS Keychain, Windows Credential Vault, Linux Secret Service)
+ * - AES-256-GCM encryption for file-based fallback
+ * - Machine-specific encryption key derivation
+ * - Environment variable support for CI/CD environments
+ */
+import { type Provider } from '../constants/defaults.js';
+/**
+ * CredentialStore class provides secure storage for sensitive credentials.
+ *
+ * It attempts to use the system keychain via keytar for maximum security,
+ * and falls back to AES-256 encrypted file storage when the keychain is
+ * unavailable (e.g., in headless environments or when keytar fails).
+ *
+ * Features:
+ * - Automatic detection of keychain availability
+ * - Transparent fallback to encrypted file storage
+ * - Machine-specific encryption key derivation
+ * - Environment variable support for CI/CD
+ * - API key format validation
+ */
+declare class CredentialStore {
+    private useKeytar;
+    private machineKey;
+    private initialized;
+    /**
+     * Initializes the credential store by testing keytar availability.
+     * Uses a cached probe result to avoid keychain write+delete on every startup.
+     * This should be called before any other operations.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Persists the keytar availability probe result to disk.
+     */
+    private saveKeytarCache;
+    /**
+     * Stores the Anthropic API key securely.
+     *
+     * @param apiKey - The API key to store
+     * @throws Error if storage fails
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * await store.setApiKey('sk-ant-api03-...');
+     * ```
+     */
+    setApiKey(apiKey: string): Promise<void>;
+    /**
+     * Retrieves the stored Anthropic API key.
+     *
+     * Checks sources in order of precedence:
+     * 1. Environment variable (ANTHROPIC_API_KEY)
+     * 2. System keychain (if available)
+     * 3. Encrypted file storage
+     *
+     * @returns The API key if found, null otherwise
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * const apiKey = await store.getApiKey();
+     * if (apiKey) {
+     *   // Use the API key
+     * }
+     * ```
+     */
+    getApiKey(): Promise<string | null>;
+    /**
+     * Deletes the stored API key from all storage locations.
+     *
+     * @returns True if deletion was successful, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * const deleted = await store.deleteApiKey();
+     * ```
+     */
+    deleteApiKey(): Promise<boolean>;
+    /**
+     * Checks if an API key is currently stored.
+     *
+     * @returns True if an API key is available (from any source)
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * if (await store.hasApiKey()) {
+     *   console.log('API key is configured');
+     * }
+     * ```
+     */
+    hasApiKey(): Promise<boolean>;
+    /**
+     * Stores the Compass API key securely.
+     *
+     * @param apiKey - The API key to store
+     * @throws Error if storage fails
+     */
+    setCompassApiKey(apiKey: string): Promise<void>;
+    /**
+     * Retrieves the stored Compass API key.
+     *
+     * Checks sources in order of precedence:
+     * 1. Environment variable (COMPASS_API_KEY)
+     * 2. System keychain (if available)
+     * 3. Encrypted file storage
+     *
+     * @returns The API key if found, null otherwise
+     */
+    getCompassApiKey(): Promise<string | null>;
+    /**
+     * Deletes the stored Compass API key from all storage locations.
+     *
+     * @returns True if deletion was successful, false otherwise
+     */
+    deleteCompassApiKey(): Promise<boolean>;
+    /**
+     * Checks if a Compass API key is currently stored.
+     *
+     * @returns True if an API key is available (from any source)
+     */
+    hasCompassApiKey(): Promise<boolean>;
+    /**
+     * Stores an API key for a specific provider.
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @param apiKey - The API key to store
+     * @throws Error if storage fails
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * await store.setProviderApiKey('ollama', 'my-ollama-key');
+     * ```
+     */
+    setProviderApiKey(provider: Provider, apiKey: string): Promise<void>;
+    /**
+     * Retrieves the stored API key for a specific provider.
+     *
+     * Checks sources in order of precedence:
+     * 1. Environment variable (provider-specific)
+     * 2. System keychain (if available)
+     * 3. Encrypted file storage
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @returns The API key if found, null otherwise
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * const apiKey = await store.getProviderApiKey('ollama');
+     * ```
+     */
+    getProviderApiKey(provider: Provider): Promise<string | null>;
+    /**
+     * Checks if an API key is stored for a specific provider.
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @returns True if an API key is available (from any source)
+     */
+    hasProviderApiKey(provider: Provider): Promise<boolean>;
+    /**
+     * Deletes the stored API key for a specific provider.
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @returns True if deletion was successful, false otherwise
+     */
+    deleteProviderApiKey(provider: Provider): Promise<boolean>;
+    /**
+     * Gets all configured providers that have API keys.
+     *
+     * @returns Array of provider names that have API keys configured
+     */
+    getConfiguredProviders(): Promise<Provider[]>;
+    /**
+     * Validates the format of an Anthropic API key.
+     *
+     * Anthropic API keys follow the format: sk-ant-api03-...
+     * This method performs basic format validation without making API calls.
+     *
+     * @param apiKey - The API key to validate
+     * @returns True if the format is valid
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * if (store.validateApiKeyFormat('sk-ant-api03-...')) {
+     *   // Key format is valid
+     * }
+     * ```
+     */
+    validateApiKeyFormat(apiKey: string): boolean;
+    /**
+     * Gets the storage method currently in use.
+     *
+     * @returns 'keychain' if using system keychain, 'file' if using encrypted file
+     */
+    getStorageMethod(): 'keychain' | 'file';
+    /**
+     * Checks if the credential store has been initialized.
+     *
+     * @returns True if initialize() has been called
+     */
+    isInitialized(): boolean;
+    /**
+     * Ensures the store is initialized before operations.
+     */
+    private ensureInitialized;
+    /**
+     * Generates a machine-specific key for encryption.
+     * Uses a combination of machine identifiers to create a unique key.
+     */
+    private getMachineKey;
+    /**
+     * Saves credentials to an encrypted file.
+     */
+    private saveToFile;
+    /**
+     * Loads credentials from the encrypted file.
+     */
+    private loadFromFile;
+    /**
+     * Deletes the encrypted credentials file.
+     */
+    private deleteFile;
+    /**
+     * Migrates credentials from file storage to keychain.
+     * Useful when keychain becomes available after initial setup.
+     *
+     * @returns True if migration was successful or not needed
+     */
+    migrateToKeychain(): Promise<boolean>;
+    /**
+     * Clears all stored credentials from all storage locations.
+     * Use with caution - this is irreversible.
+     */
+    clearAll(): Promise<void>;
+}
+/**
+ * Gets the singleton CredentialStore instance.
+ * Initializes the instance on first call.
+ *
+ * @returns Promise resolving to the initialized CredentialStore instance
+ *
+ * @example
+ * ```typescript
+ * const store = await getCredentialStore();
+ * const apiKey = await store.getApiKey();
+ * ```
+ */
+export declare function getCredentialStore(): Promise<CredentialStore>;
+/**
+ * Creates a new CredentialStore instance.
+ * Use this when you need a separate instance from the singleton.
+ *
+ * Note: You must call initialize() on the returned instance before use.
+ *
+ * @returns A new CredentialStore instance (not initialized)
+ */
+export declare function createCredentialStore(): CredentialStore;
+export { CredentialStore };
+export type { Provider };
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/services/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../src/services/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAeH,OAAO,EAAiE,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AA0HxH;;;;;;;;;;;;;GAaG;AACH,cAAM,eAAe;IACnB,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,WAAW,CAAkB;IAErC;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAyEjC;;OAEG;YACW,eAAe;IAY7B;;;;;;;;;;;OAWG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B9C;;;;;;;;;;;;;;;;;;OAkBG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqCzC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAkCtC;;;;;;;;;;;;OAYG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAKnC;;;;;OAKG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BrD;;;;;;;;;OASG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqChD;;;;OAIG;IACG,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC;IAyC7C;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAS1C;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1E;;;;;;;;;;;;;;;;OAgBG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4CnE;;;;;OAKG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7D;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA4ChE;;;;OAIG;IACG,sBAAsB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAUnD;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAyB7C;;;;OAIG;IACH,gBAAgB,IAAI,UAAU,GAAG,MAAM;IAIvC;;;;OAIG;IACH,aAAa,IAAI,OAAO;IAIxB;;OAEG;YACW,iBAAiB;IAM/B;;;OAGG;YACW,aAAa;IAuB3B;;OAEG;YACW,UAAU;IAoBxB;;OAEG;YACW,YAAY;IAgC1B;;OAEG;YACW,UAAU;IAexB;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IA6C3C;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAyBhC;AAKD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC,CAMnE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CAEvD;AAED,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,YAAY,EAAE,QAAQ,EAAE,CAAC"}