@hotfusion/cipher 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { Cipher } from "./lib/cipher";
+export { CipherError } from "./lib/cipher";
+export { Luks } from "./lib/luks";
+export type { ICipherConfig, ICipherLevel, ISecret, ISecretKey, ISecretResult, ICollection } from "./lib/cipher";
+export type { ILuks } from "./lib/luks";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAC,MAAM,cAAc,CAAA;AACnC,OAAO,EAAC,WAAW,EAAC,MAAM,cAAc,CAAA;AACxC,OAAO,EAAC,IAAI,EAAC,MAAM,YAAY,CAAA;AAI/B,YAAY,EACR,aAAa,EACb,YAAY,EACZ,OAAO,EACP,UAAU,EACV,aAAa,EACb,WAAW,EACd,MAAM,cAAc,CAAA;AAErB,YAAY,EACR,KAAK,EACR,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Luks = exports.CipherError = exports.Cipher = void 0;
+var cipher_1 = require("./lib/cipher");
+Object.defineProperty(exports, "Cipher", { enumerable: true, get: function () { return cipher_1.Cipher; } });
+var cipher_2 = require("./lib/cipher");
+Object.defineProperty(exports, "CipherError", { enumerable: true, get: function () { return cipher_2.CipherError; } });
+var luks_1 = require("./lib/luks");
+Object.defineProperty(exports, "Luks", { enumerable: true, get: function () { return luks_1.Luks; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAAmC;AAA3B,gGAAA,MAAM,OAAA;AACd,uCAAwC;AAAhC,qGAAA,WAAW,OAAA;AACnB,mCAA+B;AAAvB,4FAAA,IAAI,OAAA"}

package/dist/lib/cipher.d.ts

@@ -0,0 +1,122 @@
+import { Luks, LuksError } from './luks';
+export type ICipherLevel = 0 | 1 | 2;
+export interface ICipherConfig {
+    readonly?: boolean;
+    path: string;
+    password: string;
+    level?: ICipherLevel;
+    size?: number;
+}
+export interface ISecret {
+    id: string;
+    secret: any;
+    version: number;
+    keyName?: string;
+    meta?: {
+        readonly?: boolean;
+        version?: number;
+        __created?: number;
+        __updated?: number;
+    };
+}
+export interface ISecretKey {
+    id: string;
+    keyName?: string;
+}
+export interface ISecretResult {
+    key: {
+        [key: string]: string;
+    };
+    meta: {
+        version: number;
+        readonly?: boolean;
+    };
+    _id: number;
+}
+export interface ICollection {
+    name: string;
+    schema?: any;
+}
+export declare class CipherError extends Error {
+    code: string;
+    details?: string;
+    constructor(code: string, message: string, details?: string);
+}
+interface LokiCollection {
+    name: string;
+    insert(doc: any): any;
+    find(query?: any): any[];
+    findAndRemove(query?: any): void;
+    get(id: number): any;
+    chain(): {
+        find(query?: any): {
+            simplesort(prop: string, isDesc?: boolean): {
+                data(): any[];
+            };
+        };
+    };
+    findOne(query: any): any | null;
+    update(doc: any): void;
+    data: any[];
+    idIndex: number[] | null;
+    binaryIndices: {
+        [key: string]: {
+            name: string;
+            dirty: boolean;
+            values: number[];
+        };
+    };
+    uniqueNames: string[];
+}
+declare class SecretCollection {
+    private ajv;
+    private cipher;
+    private collection;
+    private schema;
+    constructor(cipher: Cipher, collection: LokiCollection, schema: {
+        keySchema?: any;
+    });
+    private validateKey;
+    insert(key: ISecretKey, secret: any, meta?: {
+        readonly?: boolean;
+        version?: number;
+    }): Promise<void>;
+    update(key: ISecretKey, secret: any, meta?: {
+        readonly?: boolean;
+        version?: number;
+    }): Promise<void>;
+    delete(key: ISecretKey, meta?: {
+        readonly?: boolean;
+    }): Promise<void>;
+    find(key: ISecretKey): ISecretResult | null;
+    unseal(id: string): any;
+    list(): Array<{
+        key: {
+            [key: string]: string;
+        };
+        meta: {
+            version: number;
+            readonly?: boolean;
+        };
+    }>;
+}
+export declare class Cipher {
+    private settings;
+    private collections;
+    private loki;
+    private readyPromise;
+    private luks?;
+    private mounted;
+    constructor(settings: ICipherConfig, collections?: ICollection[]);
+    private databaseInitialize;
+    canWrite(meta: any): boolean;
+    save(): Promise<void>;
+    collection(name: string): SecretCollection;
+    ready(): Promise<void>;
+    changePassword(oldPassword: string, newPassword: string): Promise<void>;
+    unmount(): Promise<void>;
+    getInfo(): any;
+    isMounted(): boolean;
+}
+export { Luks, LuksError };
+//# sourceMappingURL=cipher.d.ts.map

package/dist/lib/cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/lib/cipher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAYzC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAErC,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,GAAG,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACL;AAED,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC1B,GAAG,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC/B,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9C,GAAG,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,GAAG,CAAC;CAChB;AAID,qBAAa,WAAY,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;gBAEL,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAM9D;AAID,UAAU,cAAc;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;IACzB,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG;YAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG;gBAAE,IAAI,IAAI,GAAG,EAAE,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC;IAClG,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,MAAM,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC;IACrF,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAmED,cAAM,gBAAgB;IAClB,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAiB;IACnC,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,GAAG,CAAA;KAAE;IAOnF,OAAO,CAAC,WAAW;IAYb,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BxG,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BxG,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAS/E,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,aAAa,GAAG,IAAI;IAc3C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG;IAMvB,IAAI,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;CAMnG;AAID,qBAAa,MAAM;IACf,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,WAAW,CAA2D;IAC9E,OAAO,CAAC,IAAI,CAAe;IAC3B,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,IAAI,CAAC,CAAO;IACpB,OAAO,CAAC,OAAO,CAAkB;gBAErB,QAAQ,EAAE,aAAa,EAAE,WAAW,GAAE,WAAW,EAAsC;IA4FnG,OAAO,CAAC,kBAAkB;IAa1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO;IAKtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB;IAMpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBvE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAc9B,OAAO,IAAI,GAAG;IAWd,SAAS,IAAI,OAAO;CAGvB;AAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC"}

package/dist/lib/cipher.js

@@ -0,0 +1,362 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LuksError = exports.Luks = exports.Cipher = exports.CipherError = void 0;
+const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+//@ts-ignore
+const Loki = __importStar(require("lokijs"));
+const Ajv = __importStar(require("ajv"));
+const luks_1 = require("./luks");
+Object.defineProperty(exports, "Luks", { enumerable: true, get: function () { return luks_1.Luks; } });
+Object.defineProperty(exports, "LuksError", { enumerable: true, get: function () { return luks_1.LuksError; } });
+// ?? Encryption constants ??????????????????????????????????????????????????????
+const algorithm = 'aes-256-gcm';
+const keyLen = 32;
+const ivLen = 12;
+const saltLen = 16;
+const tagLen = 16;
+// ?? Errors ??????????????????????????????????????????????????????????????????
+class CipherError extends Error {
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'CipherError';
+    }
+}
+exports.CipherError = CipherError;
+// ?? Encrypted LokiJS adapter ??????????????????????????????????????????????????
+class EncryptedFsAdapter {
+    constructor(password) {
+        this.password = password;
+    }
+    deriveKey(salt) {
+        return crypto.pbkdf2Sync(this.password, salt, 100000, keyLen, 'sha256');
+    }
+    loadDatabase(dbname, callback) {
+        if (!fs.existsSync(dbname)) {
+            return callback(null, '{}');
+        }
+        fs.readFile(dbname, (err, data) => {
+            if (err)
+                return callback(err);
+            try {
+                const salt = data.slice(0, saltLen);
+                const iv = data.slice(saltLen, saltLen + ivLen);
+                const tag = data.slice(saltLen + ivLen, saltLen + ivLen + tagLen);
+                const encrypted = data.slice(saltLen + ivLen + tagLen);
+                const key = this.deriveKey(salt);
+                const decipher = crypto.createDecipheriv(algorithm, key, iv);
+                decipher.setAuthTag(tag);
+                let decrypted = decipher.update(encrypted, undefined, 'utf8');
+                decrypted += decipher.final('utf8');
+                callback(null, decrypted);
+            }
+            catch (e) {
+                callback(e);
+            }
+        });
+    }
+    saveDatabase(dbname, dbstring, callback) {
+        try {
+            const salt = crypto.randomBytes(saltLen);
+            const iv = crypto.randomBytes(ivLen);
+            const key = this.deriveKey(salt);
+            const cipher = crypto.createCipheriv(algorithm, key, iv);
+            let encrypted = cipher.update(dbstring, 'utf8');
+            encrypted = Buffer.concat([encrypted, cipher.final()]);
+            const tag = cipher.getAuthTag();
+            const data = Buffer.concat([salt, iv, tag, encrypted]);
+            fs.writeFile(dbname, data, (err) => {
+                if (err)
+                    return callback(err);
+                callback(null);
+            });
+        }
+        catch (e) {
+            callback(e);
+        }
+    }
+}
+// ?? SecretCollection ????????????????????????????????????????????????????????
+class SecretCollection {
+    constructor(cipher, collection, schema) {
+        this.cipher = cipher;
+        this.collection = collection;
+        this.schema = schema;
+        this.ajv = new Ajv.default({ allErrors: true });
+    }
+    validateKey(key) {
+        if (this.schema?.keySchema) {
+            const validate = this.ajv.compile(this.schema.keySchema);
+            if (!validate(key))
+                throw new CipherError('KEY_VALIDATION_FAILED', 'Key validation failed', JSON.stringify(validate.errors, null, 2));
+        }
+    }
+    async insert(key, secret, meta = {}) {
+        if (!this.cipher.canWrite(meta))
+            throw new CipherError('READONLY_MODE', 'Cannot insert: cipher is in readonly mode');
+        this.validateKey(key);
+        const id = key.id;
+        const keyName = key.keyName || 'id';
+        const existing = this.collection.findOne({ id });
+        if (existing)
+            throw new CipherError('KEY_EXISTS', `Secret with id "${id}" already exists; use update instead`);
+        const version = meta.version ?? 1;
+        if (version < 1)
+            throw new CipherError('INVALID_VERSION', 'Version must be at least 1');
+        this.collection.insert({
+            id,
+            secret,
+            version,
+            keyName,
+            meta: { ...meta, version, __created: Date.now(), __updated: Date.now() },
+        });
+        await this.cipher.save();
+    }
+    async update(key, secret, meta = {}) {
+        if (!this.cipher.canWrite(meta))
+            throw new CipherError('READONLY_MODE', 'Cannot update: cipher is in readonly mode');
+        this.validateKey(key);
+        const id = key.id;
+        const existing = this.collection.findOne({ id });
+        if (!existing)
+            throw new CipherError('KEY_NOT_FOUND', `Secret with id "${id}" not found; use insert instead`);
+        const newVersion = meta.version ?? existing.version + 1;
+        if (newVersion <= existing.version)
+            throw new CipherError('INVALID_VERSION', `Version must be higher than current (${existing.version})`);
+        existing.secret = secret;
+        existing.version = newVersion;
+        existing.meta = { ...existing.meta, ...meta, version: newVersion, __updated: Date.now() };
+        this.collection.update(existing);
+        await this.cipher.save();
+    }
+    async delete(key, meta = {}) {
+        if (!this.cipher.canWrite(meta))
+            throw new CipherError('READONLY_MODE', 'Cannot delete: cipher is in readonly mode');
+        this.validateKey(key);
+        this.collection.findAndRemove({ id: key.id });
+        await this.cipher.save();
+    }
+    find(key) {
+        this.validateKey(key);
+        const existing = this.collection.findOne({ id: key.id });
+        if (!existing)
+            return null;
+        const keyName = existing.keyName || 'id';
+        return {
+            key: { [keyName]: existing.id },
+            meta: { version: existing.version, readonly: existing.meta.readonly },
+            _id: existing.$loki,
+        };
+    }
+    unseal(id) {
+        const doc = this.collection.findOne({ id });
+        if (!doc)
+            throw new CipherError('KEY_NOT_FOUND', `Secret with id "${id}" not found`);
+        return doc.secret;
+    }
+    list() {
+        return this.collection.find().map(doc => ({
+            key: { [doc.keyName || 'id']: doc.id },
+            meta: { version: doc.version, readonly: doc.meta.readonly },
+        }));
+    }
+}
+// ?? Cipher ??????????????????????????????????????????????????????????????????
+class Cipher {
+    constructor(settings, collections = [{ name: 'secrets', schema: {} }]) {
+        this.mounted = false;
+        this.collections = new Map();
+        // Password can come from:
+        //   1. settings.password
+        //   2. --password=xxx CLI argument
+        //   3. CIPHER_PASSWORD env variable
+        const cliPassword = process.argv.find(arg => arg.startsWith('--password='))?.split('=')[1];
+        settings.password = settings.password || cliPassword || process.env.CIPHER_PASSWORD || '';
+        if (!settings.password) {
+            throw new CipherError('NO_PASSWORD', 'Cipher requires a password. Pass it via settings.password, --password=xxx CLI arg, or CIPHER_PASSWORD env variable.');
+        }
+        // Validate password strength
+        if (settings.password.length < 12) {
+            throw new CipherError('WEAK_PASSWORD', 'Password must be at least 12 characters');
+        }
+        this.settings = settings;
+        const level = settings.level ?? 0;
+        try {
+            // ?? Level 0: plain encrypted file ?????????????????????????????????????
+            if (level === 0) {
+                if (!fs.existsSync(settings.path))
+                    fs.mkdirSync(settings.path, { recursive: true, mode: 0o700 });
+            }
+            // ?? Level 1: LUKS container + encrypted file ??????????????????????????
+            else if (level === 1) {
+                if (!settings.size) {
+                    throw new CipherError('MISSING_SIZE', 'Cipher level 1 requires a size (MB) for the LUKS container');
+                }
+                this.luks = new luks_1.Luks(settings.path, {
+                    size: settings.size,
+                    password: settings.password,
+                    locked: settings.readonly ?? false,
+                });
+                this.luks.mount();
+                this.mounted = true;
+            }
+            // ?? Level 2: VM-level isolation (future) ??????????????????????????????
+            else if (level === 2) {
+                throw new CipherError('NOT_IMPLEMENTED', 'Cipher level 2 (VM-level isolation) is not yet implemented');
+            }
+            else {
+                throw new CipherError('INVALID_LEVEL', `Unknown cipher level: ${level}`);
+            }
+        }
+        catch (err) {
+            if (err instanceof CipherError)
+                throw err;
+            if (err instanceof luks_1.LuksError) {
+                throw new CipherError('LUKS_ERROR', `LUKS initialization failed: ${err.message}`, err.details);
+            }
+            throw err;
+        }
+        const adapter = new EncryptedFsAdapter(settings.password);
+        let resolveReady;
+        let rejectReady;
+        this.readyPromise = new Promise((res, rej) => {
+            resolveReady = res;
+            rejectReady = rej;
+        });
+        const dbPath = `${settings.path}/database.db`;
+        this.loki = new (Loki.default || Loki)(dbPath, {
+            adapter,
+            autoload: true,
+            autosave: false,
+            autoloadCallback: (err) => {
+                if (err) {
+                    rejectReady(err);
+                    return;
+                }
+                this.databaseInitialize(collections);
+                resolveReady();
+            },
+        });
+    }
+    databaseInitialize(collections) {
+        for (const col of collections) {
+            let collection = this.loki.getCollection(col.name);
+            if (!collection) {
+                collection = this.loki.addCollection(col.name, {
+                    indices: ['id', 'version'],
+                    unique: ['id'],
+                });
+            }
+            this.collections.set(col.name, { collection, schema: col.schema });
+        }
+    }
+    canWrite(meta) {
+        const readonlyOverride = meta.hasOwnProperty('readonly') ? meta.readonly : this.settings.readonly;
+        return !readonlyOverride;
+    }
+    async save() {
+        return new Promise((resolve, reject) => {
+            this.loki.saveDatabase((err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    collection(name) {
+        const col = this.collections.get(name);
+        if (!col)
+            throw new CipherError('COLLECTION_NOT_FOUND', `Collection "${name}" not found`);
+        return new SecretCollection(this, col.collection, col.schema);
+    }
+    async ready() {
+        return this.readyPromise;
+    }
+    async changePassword(oldPassword, newPassword) {
+        if (newPassword.length < 12) {
+            throw new CipherError('WEAK_PASSWORD', 'New password must be at least 12 characters');
+        }
+        if (this.settings.level === 1 && this.luks) {
+            try {
+                await this.luks.changePassword(oldPassword, newPassword);
+                this.settings.password = newPassword;
+            }
+            catch (err) {
+                if (err instanceof luks_1.LuksError) {
+                    throw new CipherError('PASSWORD_CHANGE_FAILED', `Failed to change password: ${err.message}`, err.details);
+                }
+                throw err;
+            }
+        }
+        else {
+            // For level 0, we would need to re-encrypt the database file
+            // This is a placeholder - implement if needed
+            throw new CipherError('NOT_IMPLEMENTED', 'Password change for level 0 encryption not yet implemented');
+        }
+    }
+    async unmount() {
+        if (this.luks && this.mounted) {
+            try {
+                this.luks.unmount();
+                this.mounted = false;
+            }
+            catch (err) {
+                if (err instanceof luks_1.LuksError) {
+                    throw new CipherError('UNMOUNT_FAILED', `Failed to unmount: ${err.message}`, err.details);
+                }
+                throw err;
+            }
+        }
+    }
+    getInfo() {
+        return {
+            level: this.settings.level ?? 0,
+            path: this.settings.path,
+            readonly: this.settings.readonly ?? false,
+            mounted: this.mounted,
+            collections: Array.from(this.collections.keys()),
+            luks: this.luks?.getInfo() ?? null,
+        };
+    }
+    isMounted() {
+        return this.mounted;
+    }
+}
+exports.Cipher = Cipher;
+//# sourceMappingURL=cipher.js.map

package/dist/lib/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/lib/cipher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,+CAAiC;AACjC,YAAY;AACZ,6CAA+B;AAC/B,yCAA2B;AAC3B,iCAAyC;AA0chC,qFA1cA,WAAI,OA0cA;AAAE,0FA1cA,gBAAS,OA0cA;AAxcxB,iFAAiF;AAEjF,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,MAAM,GAAG,EAAE,CAAC;AA2ClB,+EAA+E;AAE/E,MAAa,WAAY,SAAQ,KAAK;IAIlC,YAAY,IAAY,EAAE,OAAe,EAAE,OAAgB;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAVD,kCAUC;AA0BD,iFAAiF;AAEjF,MAAM,kBAAkB;IAGpB,YAAY,QAAgB;QACxB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IAEO,SAAS,CAAC,IAAY;QAC1B,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,QAA2C;QACpE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACpC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC;gBAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC;gBAClE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC;gBACvD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACzB,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC9D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA6B;QACxE,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACzD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,+EAA+E;AAE/E,MAAM,gBAAgB;IAMlB,YAAY,MAAc,EAAE,UAA0B,EAAE,MAA2B;QAC/E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAEO,WAAW,CAAC,GAAQ;QACxB,IAAI,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACd,MAAM,IAAI,WAAW,CACjB,uBAAuB,EACvB,uBAAuB,EACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3C,CAAC;QACV,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAe,EAAE,MAAW,EAAE,OAAiD,EAAE;QAC1F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAExF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAEjD,IAAI,QAAQ;YACR,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;QAErG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC;YACX,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QAE3E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YACnB,EAAE;YACF,MAAM;YACN,OAAO;YACP,OAAO;YACP,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;SAC3E,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAe,EAAE,MAAW,EAAE,OAAiD,EAAE;QAC1F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAExF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,QAAQ;YACT,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;QAEnG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,QAAQ,CAAC,OAAO;YAC9B,MAAM,IAAI,WAAW,CACjB,iBAAiB,EACjB,wCAAwC,QAAQ,CAAC,OAAO,GAAG,CAC9D,CAAC;QAEN,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC;QAC9B,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAE1F,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAe,EAAE,OAA+B,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAExF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,GAAe;QAChB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QACzC,OAAO;YACH,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC/B,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrE,GAAG,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC;IACN,CAAC;IAED,MAAM,CAAC,EAAU;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;QACrF,OAAO,GAAG,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,IAAI;QACA,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE;YACtC,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE;SAC9D,CAAC,CAAC,CAAC;IACR,CAAC;CACJ;AAED,+EAA+E;AAE/E,MAAa,MAAM;IAQf,YAAY,QAAuB,EAAE,cAA6B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAF3F,YAAO,GAAY,KAAK,CAAC;QAG7B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;QAE7B,0BAA0B;QAC1B,yBAAyB;QACzB,mCAAmC;QACnC,oCAAoC;QACpC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3F,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAE1F,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CACjB,aAAa,EACb,qHAAqH,CACxH,CAAC;QACN,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QAElC,IAAI,CAAC;YACD,yEAAyE;YACzE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACd,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrG,CAAC;YAED,yEAAyE;iBACpE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACjB,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,4DAA4D,CAAC,CAAC;gBACxG,CAAC;gBAED,IAAI,CAAC,IAAI,GAAG,IAAI,WAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;oBAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,IAAI,KAAK;iBACrC,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACxB,CAAC;YAED,yEAAyE;iBACpE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,WAAW,CACjB,iBAAiB,EACjB,4DAA4D,CAC/D,CAAC;YACN,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,yBAAyB,KAAK,EAAE,CAAC,CAAC;YAC7E,CAAC;QACL,CAAC;QAAC,OAAO,GAAO,EAAE,CAAC;YACf,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,IAAI,GAAG,YAAY,gBAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,+BAA+B,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,YAAyB,CAAC;QAC9B,IAAI,WAAgC,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,YAAY,GAAG,GAAG,CAAC;YACnB,WAAW,GAAG,GAAG,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,cAAc,CAAC;QAE9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE;YAC3C,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,gBAAgB,EAAE,CAAC,GAAS,EAAE,EAAE;gBAC5B,IAAI,GAAG,EAAE,CAAC;oBACN,WAAW,CAAC,GAAG,CAAC,CAAC;oBACjB,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBACrC,YAAY,EAAE,CAAC;YACnB,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAEO,kBAAkB,CAAC,WAA0B;QACjD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE;oBAC3C,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;oBAC1B,MAAM,EAAE,CAAC,IAAI,CAAC;iBACjB,CAAC,CAAC;YACP,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAS;QACd,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClG,OAAO,CAAC,gBAAgB,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACnB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,UAAU,CAAC,IAAY;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,eAAe,IAAI,aAAa,CAAC,CAAC;QAC1F,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,WAAmB;QACzD,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,WAAW,CAAC;YACzC,CAAC;YAAC,OAAO,GAAO,EAAE,CAAC;gBACf,IAAI,GAAG,YAAY,gBAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,8BAA8B,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9G,CAAC;gBACD,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,6DAA6D;YAC7D,8CAA8C;YAC9C,MAAM,IAAI,WAAW,CACjB,iBAAiB,EACjB,4DAA4D,CAC/D,CAAC;QACN,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACT,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACzB,CAAC;YAAC,OAAO,GAAO,EAAE,CAAC;gBACf,IAAI,GAAG,YAAY,gBAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9F,CAAC;gBACD,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK;YACzC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI;SACrC,CAAC;IACN,CAAC;IAED,SAAS;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;CACJ;AA9LD,wBA8LC"}

package/dist/lib/luks.d.ts

@@ -0,0 +1,49 @@
+interface IContainer {
+    size: number;
+    directory: string;
+    password: string;
+    locked: boolean;
+}
+export type ILuks = Omit<IContainer, 'directory'>;
+export type IContainerSettings = Pick<IContainer, 'locked'>;
+export interface ILuksError {
+    code: string;
+    message: string;
+    details?: string;
+}
+declare class LuksError extends Error implements ILuksError {
+    code: string;
+    details?: string;
+    constructor(code: string, message: string, details?: string);
+}
+declare class Container {
+    private config;
+    imagepath: string;
+    id: string;
+    constructor(config: IContainer);
+    getSettings(): IContainerSettings;
+    isMounted(): boolean;
+    private executeCommand;
+    mount(): void;
+    unmount(): Container;
+    delete(force?: boolean): Container;
+    resize(targetMB: number): Container;
+    changePassword(oldPassword: string, newPassword: string): Promise<Container>;
+    getInfo(): any;
+}
+export declare class Luks {
+    private directory;
+    private config;
+    container: Container;
+    constructor(directory: string, config: ILuks);
+    static list(): any[];
+    mount(): Luks;
+    unmount(): Luks;
+    delete(force?: boolean): Luks;
+    resize(size: number): Luks;
+    changePassword(oldPassword: string, newPassword: string): Promise<Luks>;
+    getInfo(): any;
+    isMounted(): boolean;
+}
+export { LuksError };
+//# sourceMappingURL=luks.d.ts.map

package/dist/lib/luks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"luks.d.ts","sourceRoot":"","sources":["../../src/lib/luks.ts"],"names":[],"mappings":"AAMA,UAAU,UAAU;IAChB,IAAI,EAAQ,MAAM,CAAA;IAClB,SAAS,EAAG,MAAM,CAAA;IAClB,QAAQ,EAAI,MAAM,CAAA;IAClB,MAAM,EAAM,OAAO,CAAA;CACtB;AAED,MAAM,MAAM,KAAK,GAAgB,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC/D,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE5D,MAAM,WAAW,UAAU;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,cAAM,SAAU,SAAQ,KAAM,YAAW,UAAU;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;gBAEL,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAM9D;AAID,cAAM,SAAS;IACX,OAAO,CAAC,MAAM,CAAe;IAC7B,SAAS,EAAS,MAAM,CAAC;IACzB,EAAE,EAAgB,MAAM,CAAkB;gBAE9B,MAAM,EAAE,UAAU;IAW9B,WAAW,IAAI,kBAAkB;IAQjC,SAAS,IAAI,OAAO;IASpB,OAAO,CAAC,cAAc;IAiBtB,KAAK;IA+EL,OAAO,IAAI,SAAS;IAmBpB,MAAM,CAAC,KAAK,GAAE,OAAe,GAAG,SAAS;IA6BzC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;IA0D7B,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBlF,OAAO,IAAI,GAAG;CAejB;AAID,qBAAa,IAAI;IACb,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,MAAM,CAAY;IAC1B,SAAS,EAAW,SAAS,CAAC;gBAElB,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;IAM5C,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE;IAYpB,KAAK,IAAI,IAAI;IAKb,OAAO,IAAI,IAAI;IAKf,MAAM,CAAC,KAAK,GAAE,OAAe,GAAG,IAAI;IAKpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKpB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E,OAAO,IAAI,GAAG;IAId,SAAS,IAAI,OAAO;CAGvB;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/lib/luks.js

@@ -0,0 +1,302 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LuksError = exports.Luks = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path_1 = require("path");
+// ?? Errors ??????????????????????????????????????????????????????????????????
+class LuksError extends Error {
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'LuksError';
+    }
+}
+exports.LuksError = LuksError;
+// ?? Container ??????????????????????????????????????????????????????????????
+class Container {
+    constructor(config) {
+        this.id = '_.cipher.img';
+        this.config = config;
+        this.id = `_.${(0, path_1.basename)(this.config.directory).replace(/[^a-z0-9-]/gi, '_')}`;
+        this.imagepath = `${(0, path_1.dirname)(this.config.directory)}/${this.id}.img`;
+        // Validate password strength
+        if (this.config.password.length < 12) {
+            throw new LuksError('WEAK_PASSWORD', 'Password must be at least 12 characters');
+        }
+    }
+    getSettings() {
+        try {
+            return JSON.parse(fs.readFileSync((0, path_1.join)(this.config.directory, "_.settings.json")).toString());
+        }
+        catch (e) {
+            return { locked: false };
+        }
+    }
+    isMounted() {
+        try {
+            (0, child_process_1.execSync)(`mountpoint -q ${this.config.directory}`);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    executeCommand(cmd, description) {
+        try {
+            const output = (0, child_process_1.execSync)(cmd, {
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout: 30000 // 30 second timeout
+            });
+            return output.toString();
+        }
+        catch (err) {
+            const errorMsg = err.stderr?.toString() || err.message || String(err);
+            throw new LuksError('EXEC_FAILED', `${description} failed`, errorMsg);
+        }
+    }
+    mount() {
+        try {
+            // Check if already mounted
+            if (this.isMounted()) {
+                return;
+            }
+            // Create directories
+            if (!fs.existsSync(this.config.directory))
+                fs.mkdirSync(this.config.directory, { recursive: true, mode: 0o700 });
+            if (!fs.existsSync((0, path_1.dirname)(this.imagepath)))
+                fs.mkdirSync((0, path_1.dirname)(this.imagepath), { recursive: true, mode: 0o700 });
+            // New container - create and format
+            if (!fs.existsSync(this.imagepath)) {
+                console.log(`Creating LUKS container at ${this.imagepath} (${this.config.size}MB)...`);
+                // Create disk image
+                this.executeCommand(`dd if=/dev/zero of=${this.imagepath} bs=1M count=${this.config.size} 2>/dev/null`, 'Create disk image');
+                // Format as LUKS
+                this.executeCommand(`echo -n "${this.config.password.replace(/"/g, '\\"')}" | cryptsetup luksFormat --batch-mode ${this.imagepath}`, 'Format LUKS container');
+                // Open LUKS
+                this.executeCommand(`echo -n "${this.config.password.replace(/"/g, '\\"')}" | cryptsetup luksOpen ${this.imagepath} ${this.id}`, 'Open LUKS container');
+                // Create filesystem
+                this.executeCommand(`mkfs.ext4 -F /dev/mapper/${this.id} -q`, 'Create ext4 filesystem');
+                // Mount
+                this.executeCommand(`mount -o defaults /dev/mapper/${this.id} ${this.config.directory}`, 'Mount filesystem');
+                // Write settings
+                fs.writeFileSync((0, path_1.join)(this.config.directory, "_.settings.json"), JSON.stringify({ locked: this.config.locked }, null, 2), { mode: 0o600 });
+                console.log(`✓ LUKS container mounted at ${this.config.directory}`);
+            }
+            // Existing container - open and mount
+            else {
+                console.log(`Opening existing LUKS container at ${this.imagepath}...`);
+                this.executeCommand(`echo -n "${this.config.password.replace(/"/g, '\\"')}" | cryptsetup luksOpen ${this.imagepath} ${this.id}`, 'Open LUKS container');
+                this.executeCommand(`mount -o defaults /dev/mapper/${this.id} ${this.config.directory}`, 'Mount filesystem');
+                console.log(`✓ LUKS container mounted at ${this.config.directory}`);
+            }
+        }
+        catch (err) {
+            if (err instanceof LuksError)
+                throw err;
+            throw new LuksError('MOUNT_FAILED', 'Failed to mount container', String(err));
+        }
+    }
+    unmount() {
+        try {
+            if (!this.isMounted()) {
+                return this;
+            }
+            this.executeCommand(`umount ${this.config.directory}`, 'Unmount filesystem');
+            this.executeCommand(`cryptsetup luksClose ${this.id}`, 'Close LUKS container');
+            console.log(`✓ LUKS container unmounted`);
+        }
+        catch (err) {
+            // Don't throw on unmount - try to force unmount
+            try {
+                (0, child_process_1.execSync)(`umount -f ${this.config.directory} 2>/dev/null`);
+                (0, child_process_1.execSync)(`cryptsetup luksClose ${this.id} 2>/dev/null`);
+            }
+            catch { }
+        }
+        return this;
+    }
+    delete(force = false) {
+        try {
+            this.mount();
+            if (this.getSettings()?.locked && !force) {
+                throw new LuksError('CONTAINER_LOCKED', 'Container is protected from deletion. Use force: true to override');
+            }
+            this.unmount();
+            if (fs.existsSync(this.config.directory)) {
+                fs.rmSync(this.config.directory, { recursive: true, force: true });
+            }
+            if (fs.existsSync(this.imagepath)) {
+                fs.unlinkSync(this.imagepath);
+            }
+            console.log(`✓ LUKS container deleted`);
+        }
+        catch (err) {
+            if (err instanceof LuksError)
+                throw err;
+            throw new LuksError('DELETE_FAILED', 'Failed to delete container', String(err));
+        }
+        return this;
+    }
+    resize(targetMB) {
+        try {
+            if (!this.isMounted()) {
+                this.mount();
+            }
+            // Calculate space requirements
+            const usedOutput = (0, child_process_1.execSync)(`du -sb ${this.config.directory}`, { encoding: 'utf-8' });
+            const usedBytes = parseInt(usedOutput.split(/\s+/)[0], 10);
+            const usedMB = Math.ceil(usedBytes / (1024 * 1024));
+            const bufferMB = Math.max(5, Math.ceil(usedMB * 0.1)); // 10% buffer
+            const minMB = usedMB + bufferMB;
+            if (targetMB < minMB) {
+                console.warn(`Target ${targetMB}MB too small, resizing to ${minMB}MB (used: ${usedMB}MB + buffer: ${bufferMB}MB)`);
+                targetMB = minMB;
+            }
+            // Check available disk space
+            const dfOutput = (0, child_process_1.execSync)(`df -B1 ${(0, path_1.dirname)(this.imagepath)}`, { encoding: 'utf-8' }).split('\n')[1];
+            const freeBytes = parseInt(dfOutput.split(/\s+/)[3], 10);
+            const freeMB = Math.floor(freeBytes / (1024 * 1024));
+            if (targetMB > freeMB) {
+                throw new LuksError('INSUFFICIENT_SPACE', `Target ${targetMB}MB exceeds available space ${freeMB}MB`);
+            }
+            const currentSizeBytes = fs.statSync(this.imagepath).size;
+            const currentSizeMB = Math.ceil(currentSizeBytes / (1024 * 1024));
+            const isShrinking = targetMB < currentSizeMB;
+            console.log(`Resizing container from ${currentSizeMB}MB to ${targetMB}MB...`);
+            if (isShrinking) {
+                // Shrink: check → resize fs → resize crypto → truncate
+                this.executeCommand(`e2fsck -f -y /dev/mapper/${this.id}`, 'Check filesystem');
+                this.executeCommand(`resize2fs /dev/mapper/${this.id} ${targetMB}M`, 'Resize filesystem');
+                this.executeCommand(`cryptsetup resize ${this.id}`, 'Resize crypto layer');
+                this.executeCommand(`truncate -s ${targetMB}M ${this.imagepath}`, 'Truncate image');
+            }
+            else {
+                // Grow: truncate → resize crypto → resize fs → check
+                this.executeCommand(`truncate -s ${targetMB}M ${this.imagepath}`, 'Truncate image');
+                this.executeCommand(`cryptsetup resize ${this.id}`, 'Resize crypto layer');
+                this.executeCommand(`resize2fs /dev/mapper/${this.id} ${targetMB}M`, 'Resize filesystem');
+                this.executeCommand(`e2fsck -f -y /dev/mapper/${this.id}`, 'Check filesystem');
+            }
+            console.log(`✓ Container resized to ${targetMB}MB`);
+        }
+        catch (err) {
+            if (err instanceof LuksError)
+                throw err;
+            throw new LuksError('RESIZE_FAILED', 'Failed to resize container', String(err));
+        }
+        return this;
+    }
+    async changePassword(oldPassword, newPassword) {
+        try {
+            if (newPassword.length < 12) {
+                throw new LuksError('WEAK_PASSWORD', 'New password must be at least 12 characters');
+            }
+            console.log('Changing LUKS password...');
+            this.executeCommand(`echo -e "${oldPassword.replace(/"/g, '\\"')}\n${newPassword.replace(/"/g, '\\"')}" | cryptsetup luksChangeKey ${this.imagepath}`, 'Change LUKS password');
+            this.config.password = newPassword;
+            console.log(`✓ Password changed successfully`);
+        }
+        catch (err) {
+            if (err instanceof LuksError)
+                throw err;
+            throw new LuksError('PASSWORD_CHANGE_FAILED', 'Failed to change password', String(err));
+        }
+        return this;
+    }
+    getInfo() {
+        try {
+            const output = (0, child_process_1.execSync)(`cryptsetup luksDump ${this.imagepath}`, { encoding: 'utf-8' });
+            return {
+                locked: this.getSettings().locked,
+                mounted: this.isMounted(),
+                imagePath: this.imagepath,
+                containerPath: this.config.directory,
+                size: this.config.size,
+                raw: output
+            };
+        }
+        catch (err) {
+            throw new LuksError('INFO_FAILED', 'Failed to get container info', String(err));
+        }
+    }
+}
+// ?? Luks (Public API) ?????????????????????????????????????????????????????
+class Luks {
+    constructor(directory, config) {
+        this.directory = directory;
+        this.config = config;
+        this.container = new Container({ ...this.config, directory: this.directory });
+    }
+    static list() {
+        try {
+            const output = (0, child_process_1.execSync)("lsblk -J | jq '[.blockdevices[] | select(.fstype == null and .children != null) | {name: .name, uuid: .uuid, children: .children}]'", { encoding: 'utf-8' });
+            return JSON.parse(output);
+        }
+        catch (err) {
+            throw new LuksError('LIST_FAILED', 'Failed to list LUKS containers', String(err));
+        }
+    }
+    mount() {
+        this.container.mount();
+        return this;
+    }
+    unmount() {
+        this.container.unmount();
+        return this;
+    }
+    delete(force = false) {
+        this.container.delete(force);
+        return this;
+    }
+    resize(size) {
+        this.container.resize(size);
+        return this;
+    }
+    async changePassword(oldPassword, newPassword) {
+        await this.container.changePassword(oldPassword, newPassword);
+        return this;
+    }
+    getInfo() {
+        return this.container.getInfo();
+    }
+    isMounted() {
+        return this.container.isMounted();
+    }
+}
+exports.Luks = Luks;
+//# sourceMappingURL=luks.js.map

package/dist/lib/luks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"luks.js","sourceRoot":"","sources":["../../src/lib/luks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAyC;AACzC,uCAAyB;AACzB,+BAA8C;AAoB9C,+EAA+E;AAE/E,MAAM,SAAU,SAAQ,KAAK;IAIzB,YAAY,IAAY,EAAE,OAAe,EAAE,OAAgB;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC5B,CAAC;CACJ;AAgVQ,8BAAS;AA9UlB,8EAA8E;AAE9E,MAAM,SAAS;IAKX,YAAY,MAAkB;QAF9B,OAAE,GAAyB,cAAc,CAAC;QAGtC,IAAI,CAAC,MAAM,GAAM,MAAM,CAAC;QACxB,IAAI,CAAC,EAAE,GAAU,KAAK,IAAA,eAAQ,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,SAAS,GAAG,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC;QAEpE,6BAA6B;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;IAED,WAAW;QACP,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QACjG,CAAC;QAAC,OAAM,CAAC,EAAE,CAAC;YACR,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;IACL,CAAC;IAED,SAAS;QACL,IAAI,CAAC;YACD,IAAA,wBAAQ,EAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,GAAW,EAAE,WAAmB;QACnD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,GAAG,EAAE;gBACzB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,KAAK,CAAC,oBAAoB;aACtC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,IAAI,SAAS,CACf,aAAa,EACb,GAAG,WAAW,SAAS,EACvB,QAAQ,CACX,CAAC;QACN,CAAC;IACL,CAAC;IAED,KAAK;QACD,IAAI,CAAC;YACD,2BAA2B;YAC3B,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACnB,OAAO;YACX,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvC,EAAE,CAAC,SAAS,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAE5E,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;gBAEvF,oBAAoB;gBACpB,IAAI,CAAC,cAAc,CACf,sBAAsB,IAAI,CAAC,SAAS,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,EAClF,mBAAmB,CACtB,CAAC;gBAEF,iBAAiB;gBACjB,IAAI,CAAC,cAAc,CACf,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,EAAE,EAC/G,uBAAuB,CAC1B,CAAC;gBAEF,YAAY;gBACZ,IAAI,CAAC,cAAc,CACf,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,EAAE,EAC3G,qBAAqB,CACxB,CAAC;gBAEF,oBAAoB;gBACpB,IAAI,CAAC,cAAc,CACf,4BAA4B,IAAI,CAAC,EAAE,KAAK,EACxC,wBAAwB,CAC3B,CAAC;gBAEF,QAAQ;gBACR,IAAI,CAAC,cAAc,CACf,iCAAiC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EACnE,kBAAkB,CACrB,CAAC;gBAEF,iBAAiB;gBACjB,EAAE,CAAC,aAAa,CACZ,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACvD,EAAE,IAAI,EAAE,KAAK,EAAE,CAClB,CAAC;gBAEF,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sCAAsC;iBACjC,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;gBAEvE,IAAI,CAAC,cAAc,CACf,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,EAAE,EAC3G,qBAAqB,CACxB,CAAC;gBAEF,IAAI,CAAC,cAAc,CACf,iCAAiC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EACnE,kBAAkB,CACrB,CAAC;gBAEF,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,SAAS;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,2BAA2B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED,OAAO;QACH,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC7E,IAAI,CAAC,cAAc,CAAC,wBAAwB,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,gDAAgD;YAChD,IAAI,CAAC;gBACD,IAAA,wBAAQ,EAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,cAAc,CAAC,CAAC;gBAC3D,IAAA,wBAAQ,EAAC,wBAAwB,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,QAAiB,KAAK;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;YAEb,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,IAAI,SAAS,CACf,kBAAkB,EAClB,mEAAmE,CACtE,CAAC;YACN,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;YAEf,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,SAAS;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,4BAA4B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,QAAgB;QACnB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAED,+BAA+B;YAC/B,MAAM,UAAU,GAAG,IAAA,wBAAQ,EAAC,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;YACpE,MAAM,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;YAEhC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,UAAU,QAAQ,6BAA6B,KAAK,aAAa,MAAM,gBAAgB,QAAQ,KAAK,CAAC,CAAC;gBACnH,QAAQ,GAAG,KAAK,CAAC;YACrB,CAAC;YAED,6BAA6B;YAC7B,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,UAAU,IAAA,cAAO,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACrG,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;YAErD,IAAI,QAAQ,GAAG,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CACf,oBAAoB,EACpB,UAAU,QAAQ,8BAA8B,MAAM,IAAI,CAC7D,CAAC;YACN,CAAC;YAED,MAAM,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;YAE7C,OAAO,CAAC,GAAG,CAAC,2BAA2B,aAAa,SAAS,QAAQ,OAAO,CAAC,CAAC;YAE9E,IAAI,WAAW,EAAE,CAAC;gBACd,uDAAuD;gBACvD,IAAI,CAAC,cAAc,CAAC,4BAA4B,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAC/E,IAAI,CAAC,cAAc,CAAC,yBAAyB,IAAI,CAAC,EAAE,IAAI,QAAQ,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAC1F,IAAI,CAAC,cAAc,CAAC,qBAAqB,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAC3E,IAAI,CAAC,cAAc,CAAC,eAAe,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACxF,CAAC;iBAAM,CAAC;gBACJ,qDAAqD;gBACrD,IAAI,CAAC,cAAc,CAAC,eAAe,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBACpF,IAAI,CAAC,cAAc,CAAC,qBAAqB,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAC3E,IAAI,CAAC,cAAc,CAAC,yBAAyB,IAAI,CAAC,EAAE,IAAI,QAAQ,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAC1F,IAAI,CAAC,cAAc,CAAC,4BAA4B,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,0BAA0B,QAAQ,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,SAAS;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,4BAA4B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,WAAmB;QACzD,IAAI,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;YACxF,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACzC,IAAI,CAAC,cAAc,CACf,YAAY,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,EAAE,EACjI,sBAAsB,CACzB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,SAAS;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,uBAAuB,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxF,OAAO;gBACH,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM;gBACjC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBACpC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACtB,GAAG,EAAE,MAAM;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,8BAA8B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;CACJ;AAED,6EAA6E;AAE7E,MAAa,IAAI;IAKb,YAAY,SAAiB,EAAE,MAAa;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,IAAI;QACP,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACnB,qIAAqI,EACrI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACxB,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;IAED,KAAK;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,QAAiB,KAAK;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAY;QACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,WAAmB;QACzD,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,SAAS;QACL,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;IACtC,CAAC;CACJ;AAvDD,oBAuDC"}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@hotfusion/cipher",
+  "version": "0.0.1",
+  "description": "Vault-like secrets management with AES-256-GCM encryption and optional LUKS container support",
+  "keywords": [
+    "secrets",
+    "vault",
+    "encryption",
+    "aes-256-gcm",
+    "luks",
+    "security",
+    "key-management"
+  ],
+  "author": "Alex Loginov <you@example.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/yourusername/cipher.git"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "types": "./dist/index.d.ts"
+    },
+    "./luks": {
+      "import": "./dist/luks.js",
+      "require": "./dist/luks.cjs",
+      "types": "./dist/luks.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc && npm run build:cjs",
+    "build:cjs": "tsc --module commonjs --outDir dist",
+    "test": "vitest",
+    "test:coverage": "vitest --coverage",
+    "lint": "eslint src --ext .ts",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "ajv": "^8.12.0",
+    "lokijs": "^1.5.12"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@typescript-eslint/eslint-plugin": "^6.0.0",
+    "@typescript-eslint/parser": "^6.0.0",
+    "eslint": "^8.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^0.34.0"
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}

package/readme.md

@@ -0,0 +1,369 @@
+# @hotfusion/cipher
+
+A production-ready, Vault-like secrets management library for Node.js with **AES-256-GCM encryption** and optional **LUKS container support**.
+
+## Features
+
+✅ **AES-256-GCM encryption** - Industry-standard authenticated encryption  
+✅ **PBKDF2 key derivation** - 100,000 iterations for security  
+✅ **Three security levels:**
+- **Level 0**: Plain encrypted file (fast, no root required)
+- **Level 1**: LUKS container + AES-256-GCM (maximum security, requires root)
+- **Level 2**: VM-level isolation (coming soon)
+
+✅ **Version control** - Track secret versions, prevent downgrade attacks  
+✅ **Readonly mode** - Immutable deployments  
+✅ **Password lifecycle** - Change passwords, rotate credentials  
+✅ **LokiJS database** - In-memory with persistent encryption  
+✅ **AJV schema validation** - Optional key schemas
+
+## Installation
+
+```bash
+npm install @hotfusion/cipher
+```
+
+Or with yarn:
+```bash
+yarn add @hotfusion/cipher
+```
+
+## Quick Start
+
+### Level 0: Simple Encrypted Storage
+
+```typescript
+import { Cipher } from '@hotfusion/cipher';
+
+// Create cipher
+const cipher = new Cipher({
+    path: './secrets',
+    password: 'super-secure-password-min-12-chars',
+    level: 0 // plain encrypted file
+});
+
+await cipher.ready();
+
+// Store a secret
+const secrets = cipher.collection('secrets');
+await secrets.insert(
+    { id: 'api_key' },
+    { token: 'super-secret-token' }
+);
+
+// Retrieve a secret
+const found = secrets.find({ id: 'api_key' });
+const unsealed = secrets.unseal('api_key');
+console.log(unsealed); // { token: 'super-secret-token' }
+```
+
+### Level 1: LUKS Container (Requires root/sudo)
+
+```typescript
+const cipher = new Cipher({
+    path: '/mnt/secrets',
+    password: 'super-secure-password-min-12-chars',
+    level: 1,           // LUKS encrypted container
+    size: 1024          // 1GB container
+});
+
+await cipher.ready();
+
+// Same API as level 0
+const secrets = cipher.collection('secrets');
+await secrets.insert({ id: 'db_password' }, { pwd: '...' });
+```
+
+**Note**: Level 1 requires:
+- Linux with cryptsetup/LUKS support
+- Root/sudo access (for mount/unmount)
+- The LUKS container is automatically mounted on initialization
+
+## API Reference
+
+### Cipher
+
+#### Constructor
+
+```typescript
+new Cipher(config: ICipherConfig, collections?: ICollection[])
+```
+
+**Config options:**
+```typescript
+{
+    path: string;           // Directory to store secrets
+    password: string;       // Min 12 characters
+    level?: 0 | 1 | 2;     // Default: 0
+    size?: number;          // MB (required for level 1)
+    readonly?: boolean;     // Default: false
+}
+```
+
+**Password sources** (in order of precedence):
+1. `config.password`
+2. `--password=xxx` CLI argument
+3. `CIPHER_PASSWORD` environment variable
+
+#### Methods
+
+```typescript
+// Wait for database to load
+await cipher.ready(): Promise<void>
+
+// Get collection by name
+cipher.collection(name: string): SecretCollection
+
+// Save all changes to disk
+await cipher.save(): Promise<void>
+
+// Change password (level 1 only)
+await cipher.changePassword(oldPassword: string, newPassword: string): Promise<void>
+
+// Unmount LUKS container (level 1 only)
+await cipher.unmount(): Promise<void>
+
+// Get cipher info
+cipher.getInfo(): {
+    level: number;
+    path: string;
+    readonly: boolean;
+    mounted: boolean;
+    collections: string[];
+}
+
+// Check if container is mounted
+cipher.isMounted(): boolean
+```
+
+### SecretCollection
+
+#### Methods
+
+```typescript
+// Insert a new secret (fails if exists)
+await collection.insert(
+    key: { id: string },
+    secret: any,
+    options?: { readonly?: boolean; version?: number }
+): Promise<void>
+
+// Update existing secret (fails if not exists)
+await collection.update(
+    key: { id: string },
+    secret: any,
+    options?: { readonly?: boolean; version?: number }
+): Promise<void>
+
+// Delete a secret
+await collection.delete(
+    key: { id: string },
+    options?: { readonly?: boolean }
+): Promise<void>
+
+// Find secret metadata
+collection.find(key: { id: string }): {
+    key: { [key: string]: string };
+    meta: { version: number; readonly?: boolean };
+    _id: number;
+} | null
+
+// Retrieve secret value
+collection.unseal(id: string): any
+
+// List all secrets (metadata only)
+collection.list(): Array<{ key: any; meta: any }>
+```
+
+## Examples
+
+### Full Example: API Credentials
+
+```typescript
+import { Cipher } from '@hotfusion/cipher';
+
+const cipher = new Cipher({
+    path: './vault',
+    password: process.env.VAULT_PASSWORD!,
+    level: 0
+});
+
+await cipher.ready();
+
+const creds = cipher.collection('credentials');
+
+// Store API key
+await creds.insert(
+    { id: 'github_token' },
+    {
+        token: 'ghp_xxxxxxxxxxxxxxxxxxxx',
+        scope: 'repo,gist,user'
+    }
+);
+
+// Store database password
+await creds.insert(
+    { id: 'db_password' },
+    {
+        password: 'postgres-password',
+        database: 'myapp_prod',
+        host: 'db.example.com'
+    }
+);
+
+// Update with new version
+await creds.update(
+    { id: 'github_token' },
+    {
+        token: 'ghp_new_token',
+        scope: 'repo,gist,user'
+    },
+    { version: 2 }
+);
+
+// List all secrets
+const all = creds.list();
+console.log(all);
+// [
+//   { key: { id: 'github_token' }, meta: { version: 2, readonly: false } },
+//   { key: { id: 'db_password' }, meta: { version: 1, readonly: false } }
+// ]
+
+// Retrieve secret
+const dbCreds = creds.unseal('db_password');
+console.log(dbCreds);
+// { password: 'postgres-password', database: 'myapp_prod', host: '...' }
+```
+
+### With Schema Validation
+
+```typescript
+const cipher = new Cipher({
+    path: './vault',
+    password: 'xxx',
+}, [
+    {
+        name: 'api_keys',
+        schema: {
+            keySchema: {
+                type: 'object',
+                properties: {
+                    id: { type: 'string', minLength: 3 }
+                },
+                required: ['id']
+            }
+        }
+    }
+]);
+
+await cipher.ready();
+
+const keys = cipher.collection('api_keys');
+
+// This will fail validation
+try {
+    await keys.insert({ id: 'ab' }, { token: '...' });
+} catch (err) {
+    console.error(err.message); // Key validation failed
+}
+```
+
+### Environment-based Configuration
+
+```typescript
+const cipher = new Cipher({
+    path: process.env.CIPHER_PATH || './vault',
+    password: process.env.CIPHER_PASSWORD!,
+    level: (process.env.CIPHER_LEVEL ?? 0) as any,
+    size: process.env.CIPHER_LEVEL === '1' ? 1024 : undefined,
+    readonly: process.env.NODE_ENV === 'production'
+});
+
+await cipher.ready();
+```
+
+## Security Considerations
+
+### Password Strength
+
+- Minimum **12 characters** (enforced)
+- Use strong, random passwords
+- Store in environment variables or secure vaults (not in code)
+
+### LUKS Containers (Level 1)
+
+- Requires **root/sudo** access
+- Automatically mounted during `Cipher` initialization
+- Automatically unmounted on error
+- Use for maximum security (encryption at filesystem level)
+
+### File Permissions
+
+- Database files created with mode `0o600` (read/write owner only)
+- Container directories created with mode `0o700` (rwx owner only)
+
+### Key Rotation
+
+- Secrets support versioning to prevent downgrade
+- Use `update()` with new version to rotate credentials
+- Change password with `changePassword()` (re-encrypts entire vault)
+
+### Readonly Mode
+
+- Set `readonly: true` for immutable deployments
+- Prevents any insert/update/delete operations
+- Useful for CI/CD pipelines
+
+## Error Handling
+
+```typescript
+import { Cipher, CipherError } from '@hotfusion/cipher';
+
+try {
+    const cipher = new Cipher({ path: './vault', password: 'xxx' });
+    await cipher.ready();
+} catch (err) {
+    if (err instanceof CipherError) {
+        console.error(`[${err.code}] ${err.message}`);
+        console.error(err.details);
+    }
+}
+```
+
+**Common error codes:**
+
+| Code | Meaning |
+|------|---------|
+| `NO_PASSWORD` | Password not provided |
+| `WEAK_PASSWORD` | Password < 12 characters |
+| `KEY_EXISTS` | Secret already exists |
+| `KEY_NOT_FOUND` | Secret doesn't exist |
+| `READONLY_MODE` | Cannot modify in readonly mode |
+| `COLLECTION_NOT_FOUND` | Collection doesn't exist |
+| `INVALID_VERSION` | Version constraint violated |
+| `LUKS_ERROR` | LUKS container error |
+
+## Performance
+
+- **Level 0**: ~1-5ms per operation (local SSD)
+- **Level 1**: ~5-50ms per operation (LUKS mount overhead)
+- Encryption: AES-256-GCM with 100k PBKDF2 iterations
+
+## Limitations
+
+- **Level 2** (VM-level isolation) not yet implemented
+- LUKS requires Linux + cryptsetup
+- Single-process (no distributed locking)
+- LokiJS is in-memory (loaded at startup)
+
+## License
+
+MIT
+
+## Contributing
+
+Contributions welcome! Please submit PRs to the [GitHub repository](https://github.com/yourusername/cipher).
+
+---
+
+**Made with ❤️ for secure secrets management**