@getmyenv/crypto 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 getenv.dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,3 @@
+# @getmyenv/crypto
+
+Envelope encryption for [getmyenv](https://getmyenv.com) (Argon2id + AES-256-GCM).

package/dist/backup.d.ts

@@ -0,0 +1,29 @@
+import type { EncryptedBackupEnvelope, EncryptedSecretPayload, WrappedProjectKey } from "./types.js";
+import { encryptSecret, decryptSecret } from "./envelope.js";
+export declare function createBackupEnvelope(input: {
+    projectName: string;
+    wrappedProjectKey: WrappedProjectKey;
+    secrets: Array<{
+        name: string;
+        environment: string;
+        status: "active" | "revoked" | "placeholder";
+        expiresAt: string | null;
+        payload: EncryptedSecretPayload | null;
+    }>;
+}): EncryptedBackupEnvelope;
+export declare function serializeBackup(envelope: EncryptedBackupEnvelope): string;
+export declare function parseBackup(raw: string): EncryptedBackupEnvelope;
+/**
+ * Decrypt all secrets from a backup using the vault password.
+ * Does not require getmyenv SaaS availability.
+ * Placeholders (null payload) restore as empty values.
+ */
+export declare function restoreSecretsFromBackup(vaultPassword: string, envelope: EncryptedBackupEnvelope): Promise<Array<{
+    name: string;
+    environment: string;
+    value: string;
+    status: "active" | "revoked" | "placeholder";
+    expiresAt: string | null;
+}>>;
+export { encryptSecret, decryptSecret };
+//# sourceMappingURL=backup.d.ts.map

package/dist/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAErG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAoB,MAAM,eAAe,CAAC;AAE/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;QAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACxC,CAAC,CAAC;CACJ,GAAG,uBAAuB,CAS1B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,CAEzE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CAShE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CACR,KAAK,CAAC;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC,CACH,CASA;AAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}

package/dist/backup.js

@@ -0,0 +1,42 @@
+import { CRYPTO_FORMAT_VERSION } from "./types.js";
+import { encryptSecret, decryptSecret, unwrapProjectKey } from "./envelope.js";
+export function createBackupEnvelope(input) {
+    return {
+        format: "getmyenv-backup",
+        version: CRYPTO_FORMAT_VERSION,
+        createdAt: new Date().toISOString(),
+        projectName: input.projectName,
+        wrappedProjectKey: input.wrappedProjectKey,
+        secrets: input.secrets,
+    };
+}
+export function serializeBackup(envelope) {
+    return JSON.stringify(envelope, null, 2);
+}
+export function parseBackup(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.format !== "getmyenv-backup") {
+        throw new Error("Not a getmyenv backup file");
+    }
+    if (parsed.version !== CRYPTO_FORMAT_VERSION) {
+        throw new Error(`Unsupported backup version: ${parsed.version}`);
+    }
+    return parsed;
+}
+/**
+ * Decrypt all secrets from a backup using the vault password.
+ * Does not require getmyenv SaaS availability.
+ * Placeholders (null payload) restore as empty values.
+ */
+export async function restoreSecretsFromBackup(vaultPassword, envelope) {
+    const pek = await unwrapProjectKey(vaultPassword, envelope.wrappedProjectKey);
+    return envelope.secrets.map((s) => ({
+        name: s.name,
+        environment: s.environment,
+        value: s.payload ? decryptSecret(pek, s.payload) : "",
+        status: s.status === "placeholder" || !s.payload ? "placeholder" : s.status,
+        expiresAt: s.expiresAt,
+    }));
+}
+export { encryptSecret, decryptSecret };
+//# sourceMappingURL=backup.js.map

package/dist/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/E,MAAM,UAAU,oBAAoB,CAAC,KAUpC;IACC,OAAO;QACL,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAiC;IAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,QAAiC;IAUjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC3E,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}

package/dist/bytes.d.ts

@@ -0,0 +1,7 @@
+export declare function bytesToBase64(bytes: Uint8Array): string;
+export declare function base64ToBytes(b64: string): Uint8Array;
+export declare function getRandomBytes(length: number): Uint8Array;
+export declare function utf8Encode(text: string): Uint8Array;
+export declare function utf8Decode(bytes: Uint8Array): string;
+export declare function concatBytes(...parts: Uint8Array[]): Uint8Array;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CASvD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAUrD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOzD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAEnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEpD;AAED,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAS9D"}

package/dist/bytes.js

@@ -0,0 +1,46 @@
+export function bytesToBase64(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64");
+    }
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+export function base64ToBytes(b64) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(b64, "base64"));
+    }
+    const binary = atob(b64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export function getRandomBytes(length) {
+    const bytes = new Uint8Array(length);
+    if (typeof globalThis.crypto?.getRandomValues === "function") {
+        globalThis.crypto.getRandomValues(bytes);
+        return bytes;
+    }
+    throw new Error("Secure random generation is not available");
+}
+export function utf8Encode(text) {
+    return new TextEncoder().encode(text);
+}
+export function utf8Decode(bytes) {
+    return new TextDecoder().decode(bytes);
+}
+export function concatBytes(...parts) {
+    const total = parts.reduce((n, p) => n + p.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+//# sourceMappingURL=bytes.js.map

package/dist/bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QAC7D,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAG,KAAmB;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/envelope.d.ts

@@ -0,0 +1,30 @@
+import { type EncryptedSecretPayload, type WrappedProjectKey } from "./types.js";
+/**
+ * Create a new project encryption key and wrap it with a password-derived KEK.
+ */
+export declare function createWrappedProjectKey(vaultPassword: string): Promise<{
+    pek: Uint8Array;
+    wrapped: WrappedProjectKey;
+}>;
+/**
+ * Unwrap (decrypt) the project encryption key using the vault password.
+ */
+export declare function unwrapProjectKey(vaultPassword: string, wrapped: WrappedProjectKey): Promise<Uint8Array>;
+/**
+ * Change vault password: unwrap PEK with old password, rewrap with new.
+ * Secret ciphertext does NOT need to be re-encrypted.
+ */
+export declare function rewrapProjectKey(oldPassword: string, newPassword: string, wrapped: WrappedProjectKey): Promise<WrappedProjectKey>;
+/**
+ * Encrypt a secret value with the project encryption key.
+ */
+export declare function encryptSecret(pek: Uint8Array, plaintext: string): EncryptedSecretPayload;
+/**
+ * Decrypt a secret value with the project encryption key.
+ */
+export declare function decryptSecret(pek: Uint8Array, payload: EncryptedSecretPayload): string;
+export declare function serializePayload(payload: EncryptedSecretPayload): string;
+export declare function parsePayload(raw: string): EncryptedSecretPayload;
+export declare function serializeWrappedKey(wrapped: WrappedProjectKey): string;
+export declare function parseWrappedKey(raw: string): WrappedProjectKey;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AA+BpB;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAgB1D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,UAAU,CAAC,CASrB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,GAChB,sBAAsB,CAQxB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,sBAAsB,GAC9B,MAAM,CAaR;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAExE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAMhE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEtE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAM9D"}

package/dist/envelope.js

@@ -0,0 +1,110 @@
+import { gcm } from "@noble/ciphers/aes.js";
+import { ALGORITHM, CRYPTO_FORMAT_VERSION, DEFAULT_KDF_PARAMS, KDF, } from "./types.js";
+import { base64ToBytes, bytesToBase64, getRandomBytes, utf8Decode, utf8Encode, } from "./bytes.js";
+import { deriveKek, generateProjectKey, generateSalt } from "./kdf.js";
+const NONCE_LENGTH = 12;
+function aesGcmEncrypt(key, plaintext) {
+    const nonce = getRandomBytes(NONCE_LENGTH);
+    const aes = gcm(key, nonce);
+    const ciphertext = aes.encrypt(plaintext);
+    return { nonce, ciphertext };
+}
+function aesGcmDecrypt(key, nonce, ciphertext) {
+    const aes = gcm(key, nonce);
+    return aes.decrypt(ciphertext);
+}
+/**
+ * Create a new project encryption key and wrap it with a password-derived KEK.
+ */
+export async function createWrappedProjectKey(vaultPassword) {
+    const salt = generateSalt();
+    const kek = await deriveKek(vaultPassword, salt);
+    const pek = generateProjectKey();
+    const { nonce, ciphertext } = aesGcmEncrypt(kek, pek);
+    const wrapped = {
+        version: CRYPTO_FORMAT_VERSION,
+        salt: bytesToBase64(salt),
+        wrappedKey: bytesToBase64(ciphertext),
+        wrappedKeyNonce: bytesToBase64(nonce),
+        kdf: KDF,
+        kdfParams: { ...DEFAULT_KDF_PARAMS },
+    };
+    return { pek, wrapped };
+}
+/**
+ * Unwrap (decrypt) the project encryption key using the vault password.
+ */
+export async function unwrapProjectKey(vaultPassword, wrapped) {
+    if (wrapped.version !== CRYPTO_FORMAT_VERSION) {
+        throw new Error(`Unsupported wrapped key version: ${wrapped.version}`);
+    }
+    const salt = base64ToBytes(wrapped.salt);
+    const kek = await deriveKek(vaultPassword, salt, wrapped.kdfParams);
+    const nonce = base64ToBytes(wrapped.wrappedKeyNonce);
+    const ciphertext = base64ToBytes(wrapped.wrappedKey);
+    return aesGcmDecrypt(kek, nonce, ciphertext);
+}
+/**
+ * Change vault password: unwrap PEK with old password, rewrap with new.
+ * Secret ciphertext does NOT need to be re-encrypted.
+ */
+export async function rewrapProjectKey(oldPassword, newPassword, wrapped) {
+    const pek = await unwrapProjectKey(oldPassword, wrapped);
+    const salt = generateSalt();
+    const kek = await deriveKek(newPassword, salt);
+    const { nonce, ciphertext } = aesGcmEncrypt(kek, pek);
+    return {
+        version: CRYPTO_FORMAT_VERSION,
+        salt: bytesToBase64(salt),
+        wrappedKey: bytesToBase64(ciphertext),
+        wrappedKeyNonce: bytesToBase64(nonce),
+        kdf: KDF,
+        kdfParams: { ...DEFAULT_KDF_PARAMS },
+    };
+}
+/**
+ * Encrypt a secret value with the project encryption key.
+ */
+export function encryptSecret(pek, plaintext) {
+    const { nonce, ciphertext } = aesGcmEncrypt(pek, utf8Encode(plaintext));
+    return {
+        version: CRYPTO_FORMAT_VERSION,
+        algorithm: ALGORITHM,
+        nonce: bytesToBase64(nonce),
+        ciphertext: bytesToBase64(ciphertext),
+    };
+}
+/**
+ * Decrypt a secret value with the project encryption key.
+ */
+export function decryptSecret(pek, payload) {
+    if (payload.version !== CRYPTO_FORMAT_VERSION) {
+        throw new Error(`Unsupported secret payload version: ${payload.version}`);
+    }
+    if (payload.algorithm !== ALGORITHM) {
+        throw new Error(`Unsupported algorithm: ${payload.algorithm}`);
+    }
+    const plaintext = aesGcmDecrypt(pek, base64ToBytes(payload.nonce), base64ToBytes(payload.ciphertext));
+    return utf8Decode(plaintext);
+}
+export function serializePayload(payload) {
+    return JSON.stringify(payload);
+}
+export function parsePayload(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== CRYPTO_FORMAT_VERSION || !parsed.nonce || !parsed.ciphertext) {
+        throw new Error("Invalid encrypted secret payload");
+    }
+    return parsed;
+}
+export function serializeWrappedKey(wrapped) {
+    return JSON.stringify(wrapped);
+}
+export function parseWrappedKey(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== CRYPTO_FORMAT_VERSION || !parsed.wrappedKey || !parsed.salt) {
+        throw new Error("Invalid wrapped project key");
+    }
+    return parsed;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,kBAAkB,EAClB,GAAG,GAGJ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEvE,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,SAAS,aAAa,CACpB,GAAe,EACf,SAAqB;IAErB,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CACpB,GAAe,EACf,KAAiB,EACjB,UAAsB;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB;IAErB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAsB;QACjC,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;QACzB,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;QACrC,eAAe,EAAE,aAAa,CAAC,KAAK,CAAC;QACrC,GAAG,EAAE,GAAG;QACR,SAAS,EAAE,EAAE,GAAG,kBAAkB,EAAE;KACrC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,OAA0B;IAE1B,IAAI,OAAO,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,WAAmB,EACnB,OAA0B;IAE1B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;QACzB,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;QACrC,eAAe,EAAE,aAAa,CAAC,KAAK,CAAC;QACrC,GAAG,EAAE,GAAG;QACR,SAAS,EAAE,EAAE,GAAG,kBAAkB,EAAE;KACrC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAe,EACf,SAAiB;IAEjB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;QAC3B,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAe,EACf,OAA+B;IAE/B,IAAI,OAAO,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAC7B,GAAG,EACH,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAC5B,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAClC,CAAC;IACF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA+B;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IACpD,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/envelope.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=envelope.test.d.ts.map

package/dist/envelope.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.test.d.ts","sourceRoot":"","sources":["../src/envelope.test.ts"],"names":[],"mappings":""}

package/dist/envelope.test.js

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+import { createWrappedProjectKey, unwrapProjectKey, rewrapProjectKey, encryptSecret, decryptSecret, createBackupEnvelope, parseBackup, serializeBackup, restoreSecretsFromBackup, generateDevelopmentIdentity, signAccessRequest, verifyAccessRequest, } from "./index.js";
+describe("envelope encryption", () => {
+    it("encrypts and decrypts a secret with PEK", async () => {
+        const { pek, wrapped } = await createWrappedProjectKey("test-vault-password");
+        const payload = encryptSecret(pek, "sk-live-example");
+        expect(payload.version).toBe(1);
+        expect(decryptSecret(pek, payload)).toBe("sk-live-example");
+        const unwrapped = await unwrapProjectKey("test-vault-password", wrapped);
+        expect(decryptSecret(unwrapped, payload)).toBe("sk-live-example");
+    });
+    it("rewraps PEK on password change without re-encrypting secrets", async () => {
+        const { pek, wrapped } = await createWrappedProjectKey("old-password");
+        const payload = encryptSecret(pek, "DATABASE_URL=postgres://...");
+        const rewrapped = await rewrapProjectKey("old-password", "new-password", wrapped);
+        const newPek = await unwrapProjectKey("new-password", rewrapped);
+        expect(decryptSecret(newPek, payload)).toBe("DATABASE_URL=postgres://...");
+    });
+    it("rejects wrong password", async () => {
+        const { wrapped } = await createWrappedProjectKey("correct");
+        await expect(unwrapProjectKey("wrong", wrapped)).rejects.toThrow();
+    });
+});
+describe("backup", () => {
+    it("creates portable encrypted backup and restores", async () => {
+        const { pek, wrapped } = await createWrappedProjectKey("backup-pass");
+        const payload = encryptSecret(pek, "secret-value");
+        const envelope = createBackupEnvelope({
+            projectName: "my-app",
+            wrappedProjectKey: wrapped,
+            secrets: [
+                {
+                    name: "API_KEY",
+                    environment: "Development",
+                    status: "active",
+                    expiresAt: null,
+                    payload,
+                },
+                {
+                    name: "PENDING_KEY",
+                    environment: "Production",
+                    status: "placeholder",
+                    expiresAt: null,
+                    payload: null,
+                },
+            ],
+        });
+        const raw = serializeBackup(envelope);
+        const parsed = parseBackup(raw);
+        const restored = await restoreSecretsFromBackup("backup-pass", parsed);
+        expect(restored[0]?.value).toBe("secret-value");
+        expect(restored[1]?.status).toBe("placeholder");
+        expect(restored[1]?.value).toBe("");
+        expect(raw).not.toContain("secret-value");
+    });
+});
+describe("development identity", () => {
+    it("signs and verifies access requests", () => {
+        const id = generateDevelopmentIdentity();
+        const msg = "request:abc:project:env";
+        const sig = signAccessRequest(id.privateKey, msg);
+        expect(verifyAccessRequest(id.publicKey, msg, sig)).toBe(true);
+        expect(verifyAccessRequest(id.publicKey, "tampered", sig)).toBe(false);
+    });
+});
+//# sourceMappingURL=envelope.test.js.map

package/dist/envelope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.test.js","sourceRoot":"","sources":["../src/envelope.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,OAAO;YAC1B,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,aAAa;oBAC1B,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,IAAI;oBACf,OAAO;iBACR;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,YAAY;oBACzB,MAAM,EAAE,aAAa;oBACrB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACd;aACF;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,EAAE,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,yBAAyB,CAAC;QACtC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Development machine identity keypair.
+ * Identifies the environment  -  does NOT decrypt secrets or grant permanent access.
+ */
+export type DevelopmentKeypair = {
+    publicKey: string;
+    privateKey: string;
+};
+export declare function generateDevelopmentIdentity(): DevelopmentKeypair;
+export declare function signAccessRequest(privateKeyB64: string, message: string): string;
+export declare function verifyAccessRequest(publicKeyB64: string, message: string, signatureB64: string): boolean;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,2BAA2B,IAAI,kBAAkB,CAOhE;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAIR;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAUT"}

package/dist/identity.js

@@ -0,0 +1,24 @@
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { bytesToBase64, base64ToBytes, getRandomBytes, utf8Encode } from "./bytes.js";
+export function generateDevelopmentIdentity() {
+    const privateKey = getRandomBytes(32);
+    const publicKey = ed25519.getPublicKey(privateKey);
+    return {
+        publicKey: bytesToBase64(publicKey),
+        privateKey: bytesToBase64(privateKey),
+    };
+}
+export function signAccessRequest(privateKeyB64, message) {
+    const privateKey = base64ToBytes(privateKeyB64);
+    const sig = ed25519.sign(utf8Encode(message), privateKey);
+    return bytesToBase64(sig);
+}
+export function verifyAccessRequest(publicKeyB64, message, signatureB64) {
+    try {
+        return ed25519.verify(base64ToBytes(signatureB64), utf8Encode(message), base64ToBytes(publicKeyB64));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAWtF,MAAM,UAAU,2BAA2B;IACzC,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;QACnC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,OAAe;IAEf,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1D,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,OAAe,EACf,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CACnB,aAAa,CAAC,YAAY,CAAC,EAC3B,UAAU,CAAC,OAAO,CAAC,EACnB,aAAa,CAAC,YAAY,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./types.js";
+export * from "./bytes.js";
+export * from "./kdf.js";
+export * from "./envelope.js";
+export * from "./backup.js";
+export * from "./identity.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from "./types.js";
+export * from "./bytes.js";
+export * from "./kdf.js";
+export * from "./envelope.js";
+export * from "./backup.js";
+export * from "./identity.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/kdf.d.ts

@@ -0,0 +1,9 @@
+import { type KdfParams } from "./types.js";
+/**
+ * Derive a Key Encryption Key (KEK) from a vault password using Argon2id.
+ */
+export declare function deriveKek(password: string, salt: Uint8Array, params?: KdfParams): Promise<Uint8Array>;
+export declare function generateSalt(length?: number): Uint8Array;
+export declare function generateProjectKey(): Uint8Array;
+export declare function saltToBase64(salt: Uint8Array): string;
+//# sourceMappingURL=kdf.d.ts.map

package/dist/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../src/kdf.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAGpB;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,GAAE,SAA8B,GACrC,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED,wBAAgB,YAAY,CAAC,MAAM,SAAK,GAAG,UAAU,CAEpD;AAED,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAErD"}

package/dist/kdf.js

@@ -0,0 +1,28 @@
+import { argon2id } from "hash-wasm";
+import { DEFAULT_KDF_PARAMS, } from "./types.js";
+import { bytesToBase64, getRandomBytes } from "./bytes.js";
+/**
+ * Derive a Key Encryption Key (KEK) from a vault password using Argon2id.
+ */
+export async function deriveKek(password, salt, params = DEFAULT_KDF_PARAMS) {
+    const hash = await argon2id({
+        password,
+        salt,
+        parallelism: params.parallelism,
+        iterations: params.iterations,
+        memorySize: params.memory,
+        hashLength: params.hashLength,
+        outputType: "binary",
+    });
+    return hash instanceof Uint8Array ? hash : new Uint8Array(hash);
+}
+export function generateSalt(length = 16) {
+    return getRandomBytes(length);
+}
+export function generateProjectKey() {
+    return getRandomBytes(32);
+}
+export function saltToBase64(salt) {
+    return bytesToBase64(salt);
+}
+//# sourceMappingURL=kdf.js.map

package/dist/kdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../src/kdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,kBAAkB,GAEnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,IAAgB,EAChB,SAAoB,kBAAkB;IAEtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC;QAC1B,QAAQ;QACR,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAM,GAAG,EAAE;IACtC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,cAAc,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,50 @@
+/** Versioned getmyenv crypto protocol  -  shared by browser and CLI. */
+export declare const CRYPTO_FORMAT_VERSION: 1;
+export declare const ALGORITHM: "AES-256-GCM";
+export declare const KDF: "argon2id";
+/** Argon2id parameters (balanced for browser + CLI). */
+export declare const DEFAULT_KDF_PARAMS: {
+    readonly memory: number;
+    readonly iterations: 3;
+    readonly parallelism: 1;
+    readonly hashLength: 32;
+};
+export type KdfParams = {
+    memory: number;
+    iterations: number;
+    parallelism: number;
+    hashLength: number;
+};
+/** Wrapped project encryption key (stored server-side / in backups). */
+export type WrappedProjectKey = {
+    version: typeof CRYPTO_FORMAT_VERSION;
+    salt: string;
+    wrappedKey: string;
+    wrappedKeyNonce: string;
+    kdf: typeof KDF;
+    kdfParams: KdfParams;
+};
+/** Encrypted secret value payload. */
+export type EncryptedSecretPayload = {
+    version: typeof CRYPTO_FORMAT_VERSION;
+    algorithm: typeof ALGORITHM;
+    nonce: string;
+    ciphertext: string;
+};
+/** Portable encrypted backup envelope. */
+export type EncryptedBackupEnvelope = {
+    format: "getmyenv-backup";
+    version: typeof CRYPTO_FORMAT_VERSION;
+    createdAt: string;
+    projectName: string;
+    wrappedProjectKey: WrappedProjectKey;
+    secrets: Array<{
+        name: string;
+        environment: string;
+        status: "active" | "revoked" | "placeholder";
+        expiresAt: string | null;
+        /** Null for name-only placeholders. */
+        payload: EncryptedSecretPayload | null;
+    }>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAChD,eAAO,MAAM,SAAS,EAAG,aAAsB,CAAC;AAChD,eAAO,MAAM,GAAG,EAAG,UAAmB,CAAC;AAEvC,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,OAAO,GAAG,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF,sCAAsC;AACtC,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;QAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,uCAAuC;QACvC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACxC,CAAC,CAAC;CACJ,CAAC"}

package/dist/types.js

@@ -0,0 +1,12 @@
+/** Versioned getmyenv crypto protocol  -  shared by browser and CLI. */
+export const CRYPTO_FORMAT_VERSION = 1;
+export const ALGORITHM = "AES-256-GCM";
+export const KDF = "argon2id";
+/** Argon2id parameters (balanced for browser + CLI). */
+export const DEFAULT_KDF_PARAMS = {
+    memory: 64 * 1024, // KiB
+    iterations: 3,
+    parallelism: 1,
+    hashLength: 32,
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAU,CAAC;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,aAAsB,CAAC;AAChD,MAAM,CAAC,MAAM,GAAG,GAAG,UAAmB,CAAC;AAEvC,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM;IACzB,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,EAAE;CACN,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@getmyenv/crypto",
+  "version": "0.1.0",
+  "description": "Envelope encryption for getmyenv (Argon2id + AES-256-GCM)",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/yobotn/getmyenv.git",
+    "directory": "packages/crypto"
+  },
+  "homepage": "https://getmyenv.com",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@noble/ciphers": "^1.2.1",
+    "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.7.1",
+    "hash-wasm": "^4.12.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.10",
+    "typescript": "^5.8.2",
+    "vitest": "^4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch",
+    "test": "vitest run",
+    "lint": "tsc -p tsconfig.json --noEmit"
+  }
+}