@inkbox/sdk 0.1.3 → 0.2.0

package/dist/vault/resources/vault.js

@@ -0,0 +1,291 @@
+/**
+ * inkbox-vault/resources/vault.ts
+ *
+ * VaultResource   — org-level vault operations.
+ * UnlockedVault   — crypto-enabled wrapper for secret CRUD after unlock.
+ */
+import { computeAuthHash, decryptPayload, deriveMasterKey, deriveSalt, encryptPayload, unwrapOrgKey, } from "../crypto.js";
+import { inferSecretType, parseAccessRule, parsePayload, parseVaultInfo, parseVaultKey, parseVaultSecret, parseVaultSecretDetail, serializePayload, } from "../types.js";
+/**
+ * Org-level vault operations.
+ *
+ * Access via `inkbox.vault`. Most read-only operations work without
+ * unlocking. To create, read, or update secret payloads, call
+ * {@link unlock} first.
+ */
+export class VaultResource {
+    /** @internal */
+    http;
+    /** @internal */
+    _unlocked = null;
+    /** @internal */
+    constructor(http) {
+        this.http = http;
+    }
+    // ------------------------------------------------------------------
+    // Vault metadata
+    // ------------------------------------------------------------------
+    /** Get vault metadata for the caller's organisation. */
+    async info() {
+        const data = await this.http.get("/info");
+        return parseVaultInfo(data);
+    }
+    // ------------------------------------------------------------------
+    // Keys (read-only via API key)
+    // ------------------------------------------------------------------
+    /**
+     * List vault keys (metadata only — no wrapped key material).
+     *
+     * @param options.keyType - Optional filter: `"primary"` or `"recovery"`.
+     */
+    async listKeys(options = {}) {
+        const params = {};
+        if (options.keyType !== undefined)
+            params["type"] = options.keyType;
+        const data = await this.http.get("/keys", params);
+        return data.map(parseVaultKey);
+    }
+    // ------------------------------------------------------------------
+    // Secrets (metadata-only operations)
+    // ------------------------------------------------------------------
+    /**
+     * List vault secrets (metadata only, no encrypted payload).
+     *
+     * @param options.secretType - Optional filter: `"login"`, `"ssh_key"`,
+     *   `"api_key"`, or `"other"`.
+     */
+    async listSecrets(options = {}) {
+        const params = {};
+        if (options.secretType !== undefined)
+            params["secret_type"] = options.secretType;
+        const data = await this.http.get("/secrets", params);
+        return data.map(parseVaultSecret);
+    }
+    /**
+     * Delete a vault secret.
+     *
+     * @param secretId - UUID of the secret to delete.
+     */
+    async deleteSecret(secretId) {
+        await this.http.delete(`/secrets/${secretId}`);
+    }
+    // ------------------------------------------------------------------
+    // Access rules
+    // ------------------------------------------------------------------
+    /**
+     * List identity access rules for a vault secret.
+     *
+     * @param secretId - UUID of the secret.
+     */
+    async listAccessRules(secretId) {
+        const data = await this.http.get(`/secrets/${secretId}/access`);
+        return data.map(parseAccessRule);
+    }
+    /**
+     * Grant an identity access to a vault secret.
+     *
+     * @param secretId - UUID of the secret.
+     * @param identityId - UUID of the identity to grant access to.
+     */
+    async grantAccess(secretId, identityId) {
+        const data = await this.http.post(`/secrets/${secretId}/access`, { identity_id: identityId });
+        return parseAccessRule(data);
+    }
+    /**
+     * Revoke an identity's access to a vault secret.
+     *
+     * @param secretId - UUID of the secret.
+     * @param identityId - UUID of the identity to revoke access from.
+     */
+    async revokeAccess(secretId, identityId) {
+        await this.http.delete(`/secrets/${secretId}/access/${identityId}`);
+    }
+    // ------------------------------------------------------------------
+    // Unlock
+    // ------------------------------------------------------------------
+    /**
+     * Unlock the vault with a vault key.
+     *
+     * Derives the encryption key from the provided vault key, fetches
+     * and decrypts all vault secrets.
+     *
+     * @param vaultKey - Vault key or recovery code.
+     * @param options.identityId - Optional agent identity UUID. When
+     *   provided, only secrets that this identity has been granted access
+     *   to are included in {@link UnlockedVault.secrets}.
+     * @returns {@link UnlockedVault} with decrypted secrets and methods for
+     *   secret CRUD.
+     * @throws If the vault key is incorrect or the vault key has been deleted.
+     */
+    async unlock(vaultKey, options = {}) {
+        // Step 1: get org_id for salt derivation
+        const vaultInfo = await this.info();
+        const salt = deriveSalt(vaultInfo.organizationId);
+        // Step 2: derive master key → auth hash
+        const masterKey = await deriveMasterKey(vaultKey, salt);
+        const authHash = computeAuthHash(masterKey);
+        // Step 3: fetch wrapped key + encrypted secrets
+        // We always send auth_hash, so the server returns the singular
+        // wrapped_org_encryption_key for the matching vault key.  The
+        // plural wrapped_org_encryption_keys is only returned when
+        // auth_hash is omitted (a recovery flow this SDK does not use,
+        // since recovery codes are derived the same way as vault keys).
+        const data = await this.http.get("/unlock", {
+            auth_hash: authHash,
+        });
+        const wrapped = data.wrapped_org_encryption_key;
+        if (!wrapped) {
+            throw new Error("No vault key matched. " +
+                "Check that the vault key is correct and has not been deleted.");
+        }
+        // Step 4: unwrap the org encryption key
+        const orgKey = unwrapOrgKey(masterKey, wrapped);
+        // Step 5: decrypt all secrets from the unlock bundle
+        const decrypted = [];
+        for (const raw of data.encrypted_secrets ?? []) {
+            const detail = parseVaultSecretDetail(raw);
+            const payloadDict = decryptPayload(orgKey, detail.encryptedPayload);
+            const payload = parsePayload(detail.secretType, payloadDict);
+            decrypted.push({
+                id: detail.id,
+                name: detail.name,
+                description: detail.description,
+                secretType: detail.secretType,
+                status: detail.status,
+                createdAt: detail.createdAt,
+                updatedAt: detail.updatedAt,
+                payload,
+            });
+        }
+        // Always store the unfiltered vault so identity.getCredentials()
+        // has the full set to filter from, even when identityId is provided.
+        this._unlocked = new UnlockedVault(this.http, orgKey, [...decrypted]);
+        // Step 6 (optional): filter by identity access rules
+        if (options.identityId !== undefined) {
+            const idStr = options.identityId;
+            const filtered = [];
+            for (const secret of decrypted) {
+                const rules = await this.http.get(`/secrets/${secret.id}/access`);
+                if (rules.some((r) => r.identity_id === idStr)) {
+                    filtered.push(secret);
+                }
+            }
+            return new UnlockedVault(this.http, orgKey, filtered);
+        }
+        return this._unlocked;
+    }
+}
+/**
+ * A vault unlocked with a valid vault key.
+ *
+ * Provides transparent encrypt/decrypt for secret CRUD operations.
+ *
+ * Obtain via {@link VaultResource.unlock}.
+ */
+export class UnlockedVault {
+    http;
+    orgKey;
+    secretsCache;
+    constructor(http, orgKey, secretsCache) {
+        this.http = http;
+        this.orgKey = orgKey;
+        this.secretsCache = secretsCache;
+    }
+    /** All vault secrets decrypted from the unlock response. */
+    get secrets() {
+        return [...this.secretsCache];
+    }
+    // ------------------------------------------------------------------
+    // Encrypted CRUD
+    // ------------------------------------------------------------------
+    /**
+     * Fetch and decrypt a single vault secret.
+     *
+     * @param secretId - UUID of the secret.
+     */
+    async getSecret(secretId) {
+        const data = await this.http.get(`/secrets/${secretId}`);
+        const detail = parseVaultSecretDetail(data);
+        const payloadDict = decryptPayload(this.orgKey, detail.encryptedPayload);
+        const payload = parsePayload(detail.secretType, payloadDict);
+        return {
+            id: detail.id,
+            name: detail.name,
+            description: detail.description,
+            secretType: detail.secretType,
+            status: detail.status,
+            createdAt: detail.createdAt,
+            updatedAt: detail.updatedAt,
+            payload,
+        };
+    }
+    /**
+     * Encrypt and store a new secret.
+     *
+     * The `secretType` is inferred from the payload shape.
+     *
+     * @param options.name - Display name (max 255 characters).
+     * @param options.description - Optional description.
+     * @param options.payload - One of {@link LoginPayload}, {@link SSHKeyPayload},
+     *   {@link APIKeyPayload}, or {@link OtherPayload}.
+     */
+    async createSecret(options) {
+        const secretType = inferSecretType(options.payload);
+        const serialized = serializePayload(secretType, options.payload);
+        const encrypted = encryptPayload(this.orgKey, serialized);
+        const body = {
+            name: options.name,
+            secret_type: secretType,
+            encrypted_payload: encrypted,
+        };
+        if (options.description !== undefined)
+            body["description"] = options.description;
+        const data = await this.http.post("/secrets", body);
+        return parseVaultSecret(data);
+    }
+    /**
+     * Update a vault secret's name, description, and/or encrypted payload.
+     *
+     * Only provided fields are sent to the server.
+     *
+     * **Note:** The `secretType` is immutable after creation.  If a payload
+     * is provided it must be the **same type** as the original (e.g. update
+     * a `login` secret with a new {@link LoginPayload}).  To change the
+     * type, delete the secret and create a new one.
+     *
+     * @param secretId - UUID of the secret to update.
+     * @param options.name - New display name.
+     * @param options.description - New description.
+     * @param options.payload - New payload of the **same type** as the
+     *   original (will be re-encrypted).
+     */
+    async updateSecret(secretId, options) {
+        const body = {};
+        if ("name" in options)
+            body["name"] = options.name;
+        if ("description" in options)
+            body["description"] = options.description;
+        if (options.payload !== undefined) {
+            // Enforce secret_type immutability — the server treats the
+            // payload as opaque ciphertext and cannot check this itself.
+            const current = parseVaultSecret(await this.http.get(`/secrets/${secretId}`));
+            const newType = inferSecretType(options.payload);
+            if (newType !== current.secretType) {
+                throw new TypeError(`Cannot update a '${current.secretType}' secret with a '${newType}' payload. Delete and recreate instead.`);
+            }
+            const serialized = serializePayload(newType, options.payload);
+            body["encrypted_payload"] = encryptPayload(this.orgKey, serialized);
+        }
+        const data = await this.http.patch(`/secrets/${secretId}`, body);
+        return parseVaultSecret(data);
+    }
+    /**
+     * Delete a vault secret.
+     *
+     * @param secretId - UUID of the secret to delete.
+     */
+    async deleteSecret(secretId) {
+        await this.http.delete(`/secrets/${secretId}`);
+    }
+}
+//# sourceMappingURL=vault.js.map

package/dist/vault/resources/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/vault/resources/vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAUtB,OAAO,EACL,eAAe,EACf,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACxB,gBAAgB;IACP,IAAI,CAAgB;IAE7B,gBAAgB;IAChB,SAAS,GAAyB,IAAI,CAAC;IAEvC,gBAAgB;IAChB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,iBAAiB;IACjB,qEAAqE;IAErE,wDAAwD;IACxD,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,OAAO,CAAC,CAAC;QACxD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,+BAA+B;IAC/B,qEAAqE;IAErE;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAgC,EAAE;QAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAgB,OAAO,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,qEAAqE;IACrE,qCAAqC;IACrC,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,UAAmC,EAAE;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,UAAU,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,qEAAqE;IACrE,eAAe;IACf,qEAAqE;IAErE;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,YAAY,QAAQ,SAAS,CAC9B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,UAAkB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,YAAY,QAAQ,SAAS,EAC7B,EAAE,WAAW,EAAE,UAAU,EAAE,CAC5B,CAAC;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,QAAQ,WAAW,UAAU,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,qEAAqE;IACrE,SAAS;IACT,qEAAqE;IAErE;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,UAAmC,EAAE;QAErC,yCAAyC;QACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAElD,wCAAwC;QACxC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAE5C,gDAAgD;QAChD,+DAA+D;QAC/D,8DAA8D;QAC9D,2DAA2D;QAC3D,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAyB,SAAS,EAAE;YAClE,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,0BAA0B,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,wBAAwB;gBACtB,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEhD,qDAAqD;QACrD,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,CAAC,UAAU,EACjB,WAAsC,CACvC,CAAC;YACF,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QAEtE,qDAAqD;QACrD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;YACjC,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAE/B,YAAY,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YACD,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACP,IAAI,CAAgB;IACpB,MAAM,CAAa;IACnB,YAAY,CAAyB;IAEtD,YACE,IAAmB,EACnB,MAAkB,EAClB,YAAoC;QAEpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAO;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAED,qEAAqE;IACrE,iBAAiB;IACjB,qEAAqE;IAErE;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,YAAY,QAAQ,EAAE,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,CAAC,UAAU,EACjB,WAAsC,CACvC,CAAC;QACF,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,OAIlB;QACC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,UAAU;YACvB,iBAAiB,EAAE,SAAS;SAC7B,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAiB,UAAU,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAIC;QAED,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACnD,IAAI,aAAa,IAAI,OAAO;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACxE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,2DAA2D;YAC3D,6DAA6D;YAC7D,MAAM,OAAO,GAAG,gBAAgB,CAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,YAAY,QAAQ,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CACjB,oBAAoB,OAAO,CAAC,UAAU,oBAAoB,OAAO,yCAAyC,CAC3G,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,mBAAmB,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAChC,YAAY,QAAQ,EAAE,EACtB,IAAI,CACL,CAAC;QACF,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/vault/types.d.ts

@@ -0,0 +1,236 @@
+/**
+ * inkbox-vault TypeScript SDK — public types.
+ *
+ * Includes API response types, raw JSON shapes, parsers,
+ * and client-side structured secret payloads.
+ */
+/**
+ * Category of credential stored in a vault secret.
+ *
+ * Used as a client-side hint for which form to render. The server
+ * does not validate or enforce payload structure (it's opaque ciphertext).
+ */
+export declare const VaultSecretType: {
+    readonly API_KEY: "api_key";
+    readonly KEY_PAIR: "key_pair";
+    readonly LOGIN: "login";
+    readonly SSH_KEY: "ssh_key";
+    readonly OTHER: "other";
+};
+export type VaultSecretType = (typeof VaultSecretType)[keyof typeof VaultSecretType];
+/**
+ * Discriminator for vault key records.
+ *
+ * - `PRIMARY` — a standard vault key issued to users or agents.
+ * - `RECOVERY` — a recovery code generated at vault initialization.
+ */
+export declare const VaultKeyType: {
+    readonly PRIMARY: "primary";
+    readonly RECOVERY: "recovery";
+};
+export type VaultKeyType = (typeof VaultKeyType)[keyof typeof VaultKeyType];
+/** Vault metadata returned by the info endpoint. */
+export interface VaultInfo {
+    id: string;
+    organizationId: string;
+    /** @example "active" */
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+    /** Number of active primary vault keys. */
+    keyCount: number;
+    /** Number of active vault secrets. */
+    secretCount: number;
+    /** Number of active recovery keys. */
+    recoveryKeyCount: number;
+}
+/** Vault key metadata (no wrapped key material). */
+export interface VaultKey {
+    id: string;
+    /** `"primary"` or `"recovery"` */
+    keyType: string;
+    /** Clerk user ID of the creator, or `null`. */
+    createdBy: string | null;
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Vault secret metadata (no encrypted payload). */
+export interface VaultSecret {
+    id: string;
+    /** Display name. */
+    name: string;
+    /** Optional description. */
+    description: string | null;
+    /** `"login"` | `"ssh_key"` | `"api_key"` | `"other"` */
+    secretType: string;
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Vault secret including the encrypted payload. */
+export interface VaultSecretDetail extends VaultSecret {
+    /** Base64-encoded AES-256-GCM ciphertext. */
+    encryptedPayload: string;
+}
+/** A rule granting an identity access to a vault secret. */
+export interface AccessRule {
+    id: string;
+    vaultSecretId: string;
+    identityId: string;
+    createdAt: Date;
+}
+/** @internal */
+export interface RawAccessRule {
+    id: string;
+    vault_secret_id: string;
+    identity_id: string;
+    created_at: string;
+}
+/** @internal */
+export declare function parseAccessRule(r: RawAccessRule): AccessRule;
+/** Payload for `login` secrets. At least one of `username` or `email` should be provided. */
+export interface LoginPayload {
+    password: string;
+    username?: string;
+    email?: string;
+    /** URL of the service. */
+    url?: string;
+    notes?: string;
+}
+/** Payload for `other` (freeform catch-all) secrets. */
+export interface OtherPayload {
+    /** Freeform content. */
+    data: string;
+    notes?: string;
+}
+/** Payload for `ssh_key` secrets. */
+export interface SSHKeyPayload {
+    /** SSH private key (PEM or OpenSSH format). */
+    privateKey: string;
+    publicKey?: string;
+    fingerprint?: string;
+    /** Passphrase protecting the private key, if any. */
+    passphrase?: string;
+    notes?: string;
+}
+/** Payload for `api_key` secrets (single token). */
+export interface APIKeyPayload {
+    /** The API key or token. */
+    apiKey: string;
+    /** API endpoint URL. */
+    endpoint?: string;
+    notes?: string;
+}
+/** Payload for `key_pair` secrets (access key + secret key). */
+export interface KeyPairPayload {
+    /** The access key identifier. */
+    accessKey: string;
+    /** The secret key. */
+    secretKey: string;
+    /** API endpoint URL. */
+    endpoint?: string;
+    notes?: string;
+}
+/** Union of all secret payload types. */
+export type SecretPayload = LoginPayload | OtherPayload | SSHKeyPayload | APIKeyPayload | KeyPairPayload;
+/** A vault secret with its payload decrypted into a structured type. */
+export interface DecryptedVaultSecret {
+    id: string;
+    /** Display name. */
+    name: string;
+    description: string | null;
+    /** `"login"` | `"ssh_key"` | `"api_key"` | `"other"` */
+    secretType: string;
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+    /** The decrypted, structured payload. */
+    payload: SecretPayload;
+}
+/** @internal */
+export interface RawVaultInfo {
+    id: string;
+    organization_id: string;
+    status: string;
+    created_at: string;
+    updated_at: string;
+    key_count: number;
+    secret_count: number;
+    recovery_key_count: number;
+}
+/** @internal */
+export interface RawVaultKey {
+    id: string;
+    key_type: string;
+    created_by: string | null;
+    status: string;
+    created_at: string;
+    updated_at: string;
+}
+/** @internal */
+export interface RawVaultSecret {
+    id: string;
+    name: string;
+    description: string | null;
+    secret_type: string;
+    status: string;
+    created_at: string;
+    updated_at: string;
+}
+/** @internal */
+export interface RawVaultSecretDetail extends RawVaultSecret {
+    encrypted_payload: string;
+}
+/** @internal */
+export interface RawVaultUnlockResponse {
+    wrapped_org_encryption_key: string | null;
+    wrapped_org_encryption_keys: Array<{
+        id: string;
+        auth_hash: string;
+        wrapped_org_encryption_key: string;
+    }> | null;
+    encrypted_secrets: RawVaultSecretDetail[];
+}
+/** Parse a raw vault info response into a {@link VaultInfo}. @internal */
+export declare function parseVaultInfo(r: RawVaultInfo): VaultInfo;
+/** Parse a raw vault key response into a {@link VaultKey}. @internal */
+export declare function parseVaultKey(r: RawVaultKey): VaultKey;
+/** Parse a raw vault secret response into a {@link VaultSecret}. @internal */
+export declare function parseVaultSecret(r: RawVaultSecret): VaultSecret;
+/** Parse a raw vault secret detail response into a {@link VaultSecretDetail}. @internal */
+export declare function parseVaultSecretDetail(r: RawVaultSecretDetail): VaultSecretDetail;
+/**
+ * Serialize a payload into a plain object for encryption.
+ *
+ * Converts camelCase payload fields to the snake_case wire format
+ * stored inside the encrypted blob.
+ *
+ * @param secretType - The secret type string.
+ * @param payload - The structured payload to serialize.
+ * @returns A plain object ready for JSON stringification.
+ * @throws If `secretType` is unknown.
+ * @internal
+ */
+export declare function serializePayload(secretType: string, payload: SecretPayload): Record<string, unknown>;
+/**
+ * Parse a decrypted plain object into the correct payload type.
+ *
+ * Converts snake_case wire-format fields back to camelCase.
+ *
+ * @param secretType - The secret type string.
+ * @param raw - The decrypted plain object.
+ * @returns The typed payload.
+ * @throws If `secretType` is unknown.
+ * @internal
+ */
+export declare function parsePayload(secretType: string, raw: Record<string, unknown>): SecretPayload;
+/**
+ * Infer the `secretType` string from a payload's shape.
+ *
+ * @param payload - A secret payload object.
+ * @returns The inferred secret type string.
+ * @throws If the payload shape doesn't match any known type.
+ */
+export declare function inferSecretType(payload: SecretPayload): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/vault/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAI5E,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,oDAAoD;AACpD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gBAAgB;AAChB,wBAAgB,eAAe,CAAC,CAAC,EAAE,aAAa,GAAG,UAAU,CAO5D;AAID,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,aAAa,GACb,cAAc,CAAC;AAEnB,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE,aAAa,CAAC;CACxB;AAID,gBAAgB;AAChB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,gBAAgB;AAChB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gBAAgB;AAChB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gBAAgB;AAChB,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,gBAAgB;AAChB,MAAM,WAAW,sBAAsB;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,2BAA2B,EACvB,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,0BAA0B,EAAE,MAAM,CAAA;KAAE,CAAC,GAC5E,IAAI,CAAC;IACT,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;CAC3C;AAID,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,SAAS,CAWzD;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAStD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,cAAc,GAAG,WAAW,CAU/D;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,oBAAoB,GAAG,iBAAiB,CAKjF;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,aAAa,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8CzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,aAAa,CAoCf;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAO9D"}