@executioncontrolprotocol/browser-secrets 0.10.0

package/README.md

@@ -0,0 +1,50 @@
+# @executioncontrolprotocol/browser-secrets
+
+Passphrase-protected encrypted secrets for browser ECP environments.
+
+## Fluent helper
+
+Environment bindings use `browser("KEY")`, which serializes to `{ "$browser": "KEY" }` in manifests:
+
+```ts
+import { browser, extension } from "@executioncontrolprotocol/browser"
+
+extension("@executioncontrolprotocol/openai").with({
+  apiKey: browser("OPENAI_API_KEY", { optional: true }),
+})
+extension("@executioncontrolprotocol/browser-secrets").with({})
+```
+
+## Storage model
+
+| Artifact | Location | Purpose |
+| -------- | -------- | ------- |
+| KDF salt | `localStorage` (`ecp:browser-secrets:v1:salt`) | PBKDF2 salt |
+| Verifier | `localStorage` (`ecp:browser-secrets:v1:verifier`) | Passphrase check |
+| Secret index | `localStorage` (`ecp:browser-secrets:v1:index`) | Logical key list |
+| Ciphertext | `localStorage` (`ecp:browser-secret:<key>`) | AES-GCM encrypted value |
+| Master key | Memory only after unlock | Never persisted |
+
+Crypto: PBKDF2 (310k iterations, SHA-256) + AES-GCM 256-bit.
+
+## Public API
+
+```ts
+import {
+  hasBrowserVault,
+  isBrowserVaultUnlocked,
+  setupBrowserVault,
+  unlockBrowserVault,
+  lockBrowserVault,
+  setBrowserSecret,
+  getBrowserSecret,
+  deleteBrowserSecret,
+  listBrowserSecretKeys,
+} from "@executioncontrolprotocol/browser-secrets"
+```
+
+The browser runtime re-exports these helpers from `@executioncontrolprotocol/browser`.
+
+## Tests
+
+Unit tests run with Node Web Crypto and an in-memory storage mock. Browser smoke tests use Vitest browser mode (`npm run test:browser`).

package/dist/constants.d.ts

@@ -0,0 +1,13 @@
+/** localStorage key for vault KDF salt. @category BrowserSecrets */
+export declare const VAULT_SALT_KEY = "ecp:browser-secrets:v1:salt";
+/** localStorage key for passphrase verifier. @category BrowserSecrets */
+export declare const VAULT_VERIFIER_KEY = "ecp:browser-secrets:v1:verifier";
+/** Prefix for encrypted secret entries in localStorage. @category BrowserSecrets */
+export declare const SECRET_STORAGE_PREFIX = "ecp:browser-secret:";
+/** localStorage index of secret key names. @category BrowserSecrets */
+export declare const SECRET_INDEX_KEY = "ecp:browser-secrets:v1:index";
+/** PBKDF2 iteration count for passphrase derivation. @category BrowserSecrets */
+export declare const PBKDF2_ITERATIONS = 310000;
+/** Verifier plaintext constant. @category BrowserSecrets */
+export declare const VAULT_VERIFIER_PLAINTEXT = "ecp-browser-secrets-v1";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,cAAc,gCAAgC,CAAA;AAE3D,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,oCAAoC,CAAA;AAEnE,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,wBAAwB,CAAA;AAE1D,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,iCAAiC,CAAA;AAE9D,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,SAAU,CAAA;AAExC,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,2BAA2B,CAAA"}

package/dist/constants.js

@@ -0,0 +1,13 @@
+/** localStorage key for vault KDF salt. @category BrowserSecrets */
+export const VAULT_SALT_KEY = "ecp:browser-secrets:v1:salt";
+/** localStorage key for passphrase verifier. @category BrowserSecrets */
+export const VAULT_VERIFIER_KEY = "ecp:browser-secrets:v1:verifier";
+/** Prefix for encrypted secret entries in localStorage. @category BrowserSecrets */
+export const SECRET_STORAGE_PREFIX = "ecp:browser-secret:";
+/** localStorage index of secret key names. @category BrowserSecrets */
+export const SECRET_INDEX_KEY = "ecp:browser-secrets:v1:index";
+/** PBKDF2 iteration count for passphrase derivation. @category BrowserSecrets */
+export const PBKDF2_ITERATIONS = 310_000;
+/** Verifier plaintext constant. @category BrowserSecrets */
+export const VAULT_VERIFIER_PLAINTEXT = "ecp-browser-secrets-v1";
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,6BAA6B,CAAA;AAE3D,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAEnE,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAA;AAE9D,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAExC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAA"}

package/dist/crypto/vault.d.ts

@@ -0,0 +1,44 @@
+import { PBKDF2_ITERATIONS } from "../constants.js";
+/** Minimal key-value storage for vault metadata and ciphertext. @category BrowserSecrets */
+export interface VaultStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** Encrypted secret record persisted in storage. @category BrowserSecrets */
+export interface EncryptedSecretRecord {
+    v: 1;
+    iv: string;
+    ciphertext: string;
+}
+export { PBKDF2_ITERATIONS };
+/** Passphrase-protected AES-GCM vault (master key in memory only). @category BrowserSecrets */
+export declare class BrowserSecretsVault {
+    private readonly storage;
+    private masterKey;
+    constructor(storage: VaultStorage);
+    /** Whether vault metadata exists in storage. */
+    hasVault(): boolean;
+    /** Whether the master key is loaded in memory. */
+    isUnlocked(): boolean;
+    /** Create a new vault with the given passphrase. */
+    setup(passphrase: string): Promise<void>;
+    /** Unlock an existing vault; returns false when passphrase is wrong. */
+    unlock(passphrase: string): Promise<boolean>;
+    /** Clear the in-memory master key. */
+    lock(): void;
+    /** Encrypt plaintext with the unlocked master key. */
+    encrypt(plaintext: string): Promise<EncryptedSecretRecord>;
+    /** Decrypt a stored record with the unlocked master key. */
+    decrypt(record: EncryptedSecretRecord): Promise<string>;
+    private requireKey;
+    private encryptWithKey;
+    private decryptWithKey;
+}
+/** In-memory storage for unit tests. @category BrowserSecrets */
+export declare function createMemoryVaultStorage(): VaultStorage & {
+    data: Map<string, string>;
+};
+/** Default localStorage-backed storage when available. @category BrowserSecrets */
+export declare function createLocalVaultStorage(): VaultStorage;
+//# sourceMappingURL=vault.d.ts.map

package/dist/crypto/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/crypto/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAIlB,MAAM,iBAAiB,CAAA;AAExB,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,CAAC,EAAE,CAAC,CAAA;IACJ,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AA+DD,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,+FAA+F;AAC/F,qBAAa,mBAAmB;IAGlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,SAAS,CAAuB;gBAEX,OAAO,EAAE,YAAY;IAElD,gDAAgD;IAChD,QAAQ,IAAI,OAAO;IAInB,kDAAkD;IAClD,UAAU,IAAI,OAAO;IAIrB,oDAAoD;IAC9C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9C,wEAAwE;IAClE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlD,sCAAsC;IACtC,IAAI,IAAI,IAAI;IAIZ,sDAAsD;IAChD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKhE,4DAA4D;IACtD,OAAO,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;IAK7D,OAAO,CAAC,UAAU;YAOJ,cAAc;YAed,cAAc;CAU7B;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,IAAI,YAAY,GAAG;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAQvF;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,IAAI,YAAY,CAStD"}

package/dist/crypto/vault.js

@@ -0,0 +1,148 @@
+import { PBKDF2_ITERATIONS, VAULT_SALT_KEY, VAULT_VERIFIER_KEY, VAULT_VERIFIER_PLAINTEXT, } from "../constants.js";
+function getCrypto() {
+    if (typeof globalThis.crypto?.subtle === "undefined") {
+        throw new Error("Web Crypto API is not available");
+    }
+    return globalThis.crypto;
+}
+function encodeBase64Url(bytes) {
+    const bin = String.fromCharCode(...bytes);
+    const b64 = typeof btoa === "function"
+        ? btoa(bin)
+        : Buffer.from(bytes).toString("base64");
+    return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function decodeBase64Url(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padLen = (4 - (padded.length % 4)) % 4;
+    const b64 = padded + "=".repeat(padLen);
+    const bin = typeof atob === "function"
+        ? atob(b64)
+        : Buffer.from(b64, "base64").toString("binary");
+    return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+function toBufferSource(bytes) {
+    return new Uint8Array(bytes);
+}
+function randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    getCrypto().getRandomValues(bytes);
+    return bytes;
+}
+async function deriveKey(passphrase, salt) {
+    const enc = new TextEncoder();
+    const baseKey = await getCrypto().subtle.importKey("raw", enc.encode(passphrase), "PBKDF2", false, ["deriveKey"]);
+    return getCrypto().subtle.deriveKey({
+        name: "PBKDF2",
+        salt: toBufferSource(salt),
+        iterations: PBKDF2_ITERATIONS,
+        hash: "SHA-256",
+    }, baseKey, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+export { PBKDF2_ITERATIONS };
+/** Passphrase-protected AES-GCM vault (master key in memory only). @category BrowserSecrets */
+export class BrowserSecretsVault {
+    storage;
+    masterKey;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    /** Whether vault metadata exists in storage. */
+    hasVault() {
+        return this.storage.getItem(VAULT_SALT_KEY) !== null;
+    }
+    /** Whether the master key is loaded in memory. */
+    isUnlocked() {
+        return this.masterKey !== undefined;
+    }
+    /** Create a new vault with the given passphrase. */
+    async setup(passphrase) {
+        if (this.hasVault()) {
+            throw new Error("Browser secrets vault already exists");
+        }
+        const salt = randomBytes(16);
+        const key = await deriveKey(passphrase, salt);
+        const verifier = await this.encryptWithKey(key, VAULT_VERIFIER_PLAINTEXT);
+        this.storage.setItem(VAULT_SALT_KEY, encodeBase64Url(salt));
+        this.storage.setItem(VAULT_VERIFIER_KEY, JSON.stringify(verifier));
+        this.masterKey = key;
+    }
+    /** Unlock an existing vault; returns false when passphrase is wrong. */
+    async unlock(passphrase) {
+        const saltRaw = this.storage.getItem(VAULT_SALT_KEY);
+        const verifierRaw = this.storage.getItem(VAULT_VERIFIER_KEY);
+        if (!saltRaw || !verifierRaw)
+            return false;
+        const salt = decodeBase64Url(saltRaw);
+        const key = await deriveKey(passphrase, salt);
+        try {
+            const record = JSON.parse(verifierRaw);
+            const plain = await this.decryptWithKey(key, record);
+            if (plain !== VAULT_VERIFIER_PLAINTEXT)
+                return false;
+            this.masterKey = key;
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Clear the in-memory master key. */
+    lock() {
+        this.masterKey = undefined;
+    }
+    /** Encrypt plaintext with the unlocked master key. */
+    async encrypt(plaintext) {
+        const key = this.requireKey();
+        return this.encryptWithKey(key, plaintext);
+    }
+    /** Decrypt a stored record with the unlocked master key. */
+    async decrypt(record) {
+        const key = this.requireKey();
+        return this.decryptWithKey(key, record);
+    }
+    requireKey() {
+        if (!this.masterKey) {
+            throw new Error("Browser secrets vault is locked");
+        }
+        return this.masterKey;
+    }
+    async encryptWithKey(key, plaintext) {
+        const iv = randomBytes(12);
+        const enc = new TextEncoder();
+        const ciphertext = await getCrypto().subtle.encrypt({ name: "AES-GCM", iv: toBufferSource(iv) }, key, enc.encode(plaintext));
+        return {
+            v: 1,
+            iv: encodeBase64Url(iv),
+            ciphertext: encodeBase64Url(new Uint8Array(ciphertext)),
+        };
+    }
+    async decryptWithKey(key, record) {
+        const iv = decodeBase64Url(record.iv);
+        const data = decodeBase64Url(record.ciphertext);
+        const plain = await getCrypto().subtle.decrypt({ name: "AES-GCM", iv: toBufferSource(iv) }, key, toBufferSource(data));
+        return new TextDecoder().decode(plain);
+    }
+}
+/** In-memory storage for unit tests. @category BrowserSecrets */
+export function createMemoryVaultStorage() {
+    const data = new Map();
+    return {
+        data,
+        getItem: (k) => data.get(k) ?? null,
+        setItem: (k, v) => data.set(k, v),
+        removeItem: (k) => data.delete(k),
+    };
+}
+/** Default localStorage-backed storage when available. @category BrowserSecrets */
+export function createLocalVaultStorage() {
+    if (typeof localStorage === "undefined") {
+        throw new Error("localStorage is not available");
+    }
+    return {
+        getItem: (k) => localStorage.getItem(k),
+        setItem: (k, v) => localStorage.setItem(k, v),
+        removeItem: (k) => localStorage.removeItem(k),
+    };
+}
+//# sourceMappingURL=vault.js.map

package/dist/crypto/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/crypto/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,iBAAiB,CAAA;AAgBxB,SAAS,SAAS;IAChB,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAA;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAA;IACzC,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACnD,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,SAAS,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAClC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAgB;IAC3D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAChD,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EACtB,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CACjC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;QAC1B,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,SAAS;KAChB,EACD,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,+FAA+F;AAC/F,MAAM,OAAO,mBAAmB;IAGD;IAFrB,SAAS,CAAuB;IAExC,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,gDAAgD;IAChD,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,CAAA;IACtD,CAAC;IAED,kDAAkD;IAClD,UAAU;QACR,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAA;IACrC,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACzE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;QAClE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;IACtB,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAA;QAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA0B,CAAA;YAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACpD,IAAI,KAAK,KAAK,wBAAwB;gBAAE,OAAO,KAAK,CAAA;YACpD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;YACpB,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI;QACF,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC5C,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,OAAO,CAAC,MAA6B;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACzC,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAc,EAAE,SAAiB;QAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;QAC7B,MAAM,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CACjD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,EAC3C,GAAG,EACH,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CACtB,CAAA;QACD,OAAO;YACL,CAAC,EAAE,CAAC;YACJ,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;YACvB,UAAU,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SACxD,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAc,EAAE,MAA6B;QACxE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,EAC3C,GAAG,EACH,cAAc,CAAC,IAAI,CAAC,CACrB,CAAA;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI;QACnC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;KAClC,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;KAC9C,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+import { BrowserSecretsVault, type VaultStorage } from "./crypto/vault.js";
+/** Replace vault storage (tests). @category BrowserSecrets */
+export declare function setBrowserSecretsStorage(next: VaultStorage): void;
+/** Replace vault instance (tests). @category BrowserSecrets */
+export declare function setBrowserSecretsVault(next: BrowserSecretsVault): void;
+/** Reset to default localStorage-backed vault. @category BrowserSecrets */
+export declare function resetBrowserSecretsVault(): void;
+/** Whether vault metadata exists. @category BrowserSecrets */
+export declare function hasBrowserVault(): boolean;
+/** Whether the vault master key is in memory. @category BrowserSecrets */
+export declare function isBrowserVaultUnlocked(): boolean;
+/** Create a new passphrase-protected vault. @category BrowserSecrets */
+export declare function setupBrowserVault(passphrase: string): Promise<void>;
+/** Unlock an existing vault. @category BrowserSecrets */
+export declare function unlockBrowserVault(passphrase: string): Promise<boolean>;
+/** Lock the vault (clear in-memory key). @category BrowserSecrets */
+export declare function lockBrowserVault(): void;
+/** Store an encrypted secret (vault must be unlocked). @category BrowserSecrets */
+export declare function setBrowserSecret(key: string, value: string): Promise<void>;
+/** Read a decrypted secret when vault is unlocked. @category BrowserSecrets */
+export declare function getBrowserSecret(key: string): Promise<string | undefined>;
+/** Remove a secret from the vault. @category BrowserSecrets */
+export declare function deleteBrowserSecret(key: string): Promise<void>;
+/** List logical secret keys in the index. @category BrowserSecrets */
+export declare function listBrowserSecretKeys(): Promise<string[]>;
+/** Browser encrypted secrets extension. @category BrowserSecrets */
+export declare const browserSecretsExtension: import("@executioncontrolprotocol/core").ExtensionDefinition;
+/** Register `@executioncontrolprotocol/browser-secrets`. @category BrowserSecrets */
+export declare function registerBrowserSecretsExtension(registry?: import("@executioncontrolprotocol/core").Registry): Promise<void>;
+export { createMemoryVaultStorage, createLocalVaultStorage, BrowserSecretsVault } from "./crypto/vault.js";
+export type { VaultStorage, EncryptedSecretRecord } from "./crypto/vault.js";
+export default browserSecretsExtension;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,mBAAmB,EAGnB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAc1B,8DAA8D;AAC9D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAGjE;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAGtE;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wEAAwE;AACxE,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,yDAAyD;AACzD,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7E;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,mFAAmF;AACnF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE/E;AAED,+DAA+D;AAC/D,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;AAED,sEAAsE;AACtE,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAE/D;AAeD,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,8DAS1B,CAAA;AAIV,qFAAqF;AACrF,wBAAsB,+BAA+B,CAAC,QAAQ,oDAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F;AAED,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC1G,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAE5E,eAAe,uBAAuB,CAAA"}

package/dist/index.js

@@ -0,0 +1,96 @@
+import { defineExtension, hook, globalRegistry, catalogExtension, BROWSER_SECRETS_RESOLVER_ID, } from "@executioncontrolprotocol/core";
+import { z } from "zod";
+import { BrowserSecretsVault, createLocalVaultStorage, createMemoryVaultStorage, } from "./crypto/vault.js";
+import { BrowserSecretStore } from "./store.js";
+const EXT_ID = "@executioncontrolprotocol/browser-secrets";
+let storage = typeof localStorage !== "undefined" ? createLocalVaultStorage() : createMemoryVaultStorage();
+let vault = new BrowserSecretsVault(storage);
+let store = new BrowserSecretStore(vault, storage);
+function refreshStore() {
+    vault = new BrowserSecretsVault(storage);
+    store = new BrowserSecretStore(vault, storage);
+}
+/** Replace vault storage (tests). @category BrowserSecrets */
+export function setBrowserSecretsStorage(next) {
+    storage = next;
+    refreshStore();
+}
+/** Replace vault instance (tests). @category BrowserSecrets */
+export function setBrowserSecretsVault(next) {
+    vault = next;
+    store = new BrowserSecretStore(vault, storage);
+}
+/** Reset to default localStorage-backed vault. @category BrowserSecrets */
+export function resetBrowserSecretsVault() {
+    storage = typeof localStorage !== "undefined" ? createLocalVaultStorage() : createMemoryVaultStorage();
+    refreshStore();
+}
+/** Whether vault metadata exists. @category BrowserSecrets */
+export function hasBrowserVault() {
+    return vault.hasVault();
+}
+/** Whether the vault master key is in memory. @category BrowserSecrets */
+export function isBrowserVaultUnlocked() {
+    return vault.isUnlocked();
+}
+/** Create a new passphrase-protected vault. @category BrowserSecrets */
+export async function setupBrowserVault(passphrase) {
+    await vault.setup(passphrase);
+}
+/** Unlock an existing vault. @category BrowserSecrets */
+export async function unlockBrowserVault(passphrase) {
+    return vault.unlock(passphrase);
+}
+/** Lock the vault (clear in-memory key). @category BrowserSecrets */
+export function lockBrowserVault() {
+    vault.lock();
+}
+/** Store an encrypted secret (vault must be unlocked). @category BrowserSecrets */
+export async function setBrowserSecret(key, value) {
+    await store.set(key, value);
+}
+/** Read a decrypted secret when vault is unlocked. @category BrowserSecrets */
+export async function getBrowserSecret(key) {
+    return store.get(key);
+}
+/** Remove a secret from the vault. @category BrowserSecrets */
+export async function deleteBrowserSecret(key) {
+    await store.delete(key);
+}
+/** List logical secret keys in the index. @category BrowserSecrets */
+export async function listBrowserSecretKeys() {
+    return store.list();
+}
+function attachBrowserSecretsResolver(ctx) {
+    const host = ctx.environment;
+    if (!host)
+        return;
+    const resolver = {
+        id: BROWSER_SECRETS_RESOLVER_ID,
+        async resolve(name) {
+            return store.get(name);
+        },
+    };
+    host.registerConfigResolver(resolver);
+}
+/** Browser encrypted secrets extension. @category BrowserSecrets */
+export const browserSecretsExtension = defineExtension("@executioncontrolprotocol", "browser-secrets")
+    .withSupportedRuntimes(["@executioncontrolprotocol/browser"])
+    .withConfig(z.object({}))
+    .withHooks([
+    hook("environment:configuring", attachBrowserSecretsResolver),
+    hook("environment:terminate", () => {
+        lockBrowserVault();
+    }),
+])
+    .build();
+catalogExtension(browserSecretsExtension);
+/** Register `@executioncontrolprotocol/browser-secrets`. @category BrowserSecrets */
+export async function registerBrowserSecretsExtension(registry = globalRegistry) {
+    if (!registry.getExtension(EXT_ID)) {
+        await registry.registerExtension(browserSecretsExtension);
+    }
+}
+export { createMemoryVaultStorage, createLocalVaultStorage, BrowserSecretsVault } from "./crypto/vault.js";
+export default browserSecretsExtension;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,2BAA2B,GAG5B,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,GAAG,2CAA2C,CAAA;AAE1D,IAAI,OAAO,GAAiB,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAA;AACxH,IAAI,KAAK,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5C,IAAI,KAAK,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AAElD,SAAS,YAAY;IACnB,KAAK,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACxC,KAAK,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AAChD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,wBAAwB,CAAC,IAAkB;IACzD,OAAO,GAAG,IAAI,CAAA;IACd,YAAY,EAAE,CAAA;AAChB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CAAC,IAAyB;IAC9D,KAAK,GAAG,IAAI,CAAA;IACZ,KAAK,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AAChD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,OAAO,GAAG,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAA;IACtG,YAAY,EAAE,CAAA;AAChB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAA;AACzB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,CAAC,UAAU,EAAE,CAAA;AAC3B,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;AACjC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB;IAC9B,KAAK,CAAC,IAAI,EAAE,CAAA;AACd,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAC/D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACvB,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAqB;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAA;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,QAAQ,GAA8B;QAC1C,EAAE,EAAE,2BAA2B;QAC/B,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;KACF,CAAA;IACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACvC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC,2BAA2B,EAAE,iBAAiB,CAAC;KACnG,qBAAqB,CAAC,CAAC,mCAAmC,CAAC,CAAC;KAC5D,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;KACxB,SAAS,CAAC;IACT,IAAI,CAAC,yBAAyB,EAAE,4BAA4B,CAAC;IAC7D,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACjC,gBAAgB,EAAE,CAAA;IACpB,CAAC,CAAC;CACH,CAAC;KACD,KAAK,EAAE,CAAA;AAEV,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;AAEzC,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,QAAQ,GAAG,cAAc;IAC7E,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC;AAED,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAG1G,eAAe,uBAAuB,CAAA"}

package/dist/store.d.ts

@@ -0,0 +1,12 @@
+import type { BrowserSecretsVault, VaultStorage } from "./crypto/vault.js";
+/** Secret store backed by encrypted localStorage records. @category BrowserSecrets */
+export declare class BrowserSecretStore {
+    private readonly vault;
+    private readonly storage;
+    constructor(vault: BrowserSecretsVault, storage: VaultStorage);
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAyB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAqBjG,sFAAsF;AACtF,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,YAAY;IAGlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAY7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAGhC"}

package/dist/store.js

@@ -0,0 +1,58 @@
+import { SECRET_INDEX_KEY, SECRET_STORAGE_PREFIX, } from "./constants.js";
+function readIndex(storage) {
+    const raw = storage.getItem(SECRET_INDEX_KEY);
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed.filter((k) => typeof k === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeIndex(storage, keys) {
+    storage.setItem(SECRET_INDEX_KEY, JSON.stringify([...new Set(keys)].sort()));
+}
+function storageKey(logicalKey) {
+    return `${SECRET_STORAGE_PREFIX}${logicalKey}`;
+}
+/** Secret store backed by encrypted localStorage records. @category BrowserSecrets */
+export class BrowserSecretStore {
+    vault;
+    storage;
+    constructor(vault, storage) {
+        this.vault = vault;
+        this.storage = storage;
+    }
+    async get(key) {
+        if (!this.vault.isUnlocked())
+            return undefined;
+        const raw = this.storage.getItem(storageKey(key));
+        if (!raw)
+            return undefined;
+        try {
+            const record = JSON.parse(raw);
+            return await this.vault.decrypt(record);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async set(key, value) {
+        const record = await this.vault.encrypt(value);
+        this.storage.setItem(storageKey(key), JSON.stringify(record));
+        const index = readIndex(this.storage);
+        if (!index.includes(key)) {
+            writeIndex(this.storage, [...index, key]);
+        }
+    }
+    async delete(key) {
+        this.storage.removeItem(storageKey(key));
+        writeIndex(this.storage, readIndex(this.storage).filter((k) => k !== key));
+    }
+    async list() {
+        return readIndex(this.storage);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,gBAAgB,CAAA;AAGvB,SAAS,SAAS,CAAC,OAAqB;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACzC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAqB,EAAE,IAAc;IACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,GAAG,qBAAqB,GAAG,UAAU,EAAE,CAAA;AAChD,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,KAA0B,EAC1B,OAAqB;QADrB,UAAK,GAAL,KAAK,CAAqB;QAC1B,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;YAAE,OAAO,SAAS,CAAA;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAA;YACvD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QACxC,UAAU,CACR,IAAI,CAAC,OAAO,EACZ,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CACjD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;CACF"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@executioncontrolprotocol/browser-secrets",
+  "version": "0.10.0",
+  "description": "Passphrase-encrypted browser secrets vault for ECP",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "peerDependencies": {
+    "@executioncontrolprotocol/core": "^0.10.0",
+    "@executioncontrolprotocol/types": "^0.10.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@executioncontrolprotocol/core": "0.10.0",
+    "@executioncontrolprotocol/types": "0.10.0",
+    "typescript": "^5.7.0",
+    "zod": "^3.24.0"
+  }
+}