@mstone6969/vault 0.1.0

package/README.md

@@ -0,0 +1,110 @@
+# @mstone6969/vault
+
+A write-only credential vault. Values go in encrypted; the only way one comes
+back out is `open()` or `resolve()`, so a vault can sit behind an API without a
+reveal endpoint.
+
+```bash
+bun add @mstone6969/vault
+```
+
+## Use
+
+```ts
+import { generateKey, MemoryStore, Vault } from "@mstone6969/vault"
+
+const vault = new Vault({
+    key: process.env.VAULT_KEY ?? generateKey(), // 32 bytes, base64
+    store: new MemoryStore(),
+})
+
+await vault.put("alice", "stripe_key", "sk_live_…")
+
+await vault.list("alice")
+// [{ owner: "alice", name: "stripe_key", createdAt: …, updatedAt: … }]
+// — no value, ever
+
+await vault.open("alice", "stripe_key") // "sk_live_…"
+```
+
+Everything is scoped by an owner, so one vault serves many accounts and two
+people can both keep a `token` without seeing each other's.
+
+## References
+
+Configuration can name a secret instead of holding one. `resolve` swaps
+`@vault:<name>` for the stored value and leaves everything else alone:
+
+```ts
+await vault.resolve("alice", {
+    NODE_ENV: "production",
+    API_KEY: "@vault:stripe_key",
+})
+// { NODE_ENV: "production", API_KEY: "sk_live_…" }
+```
+
+A reference to a secret that isn't there **throws**. Running a job with a blank
+credential is worse than not running it. Change the prefix with
+`new Vault({ …, prefix: "secret://" })`.
+
+## Storage
+
+`MemoryStore` ships in the main entry. `SqliteStore` is Bun-only — it imports
+`bun:sqlite`, so it lives behind a subpath and never loads unless you ask for
+it:
+
+```ts
+import { SqliteStore } from "@mstone6969/vault/stores/sqlite"
+
+const store = new SqliteStore("./vault.sqlite") // or ":memory:", or a Database
+```
+
+Everything else runs on Node 18+ as well as Bun.
+
+To keep secrets in a database you already run, implement `VaultStore` — four
+methods, all scoped by owner, all dealing in sealed strings and never plaintext:
+
+```ts
+type VaultStore = {
+    get(owner: string, name: string): Promise<SecretRecord | null>
+    list(owner: string): Promise<SecretRecord[]>
+    put(record: { owner: string; name: string; sealed: string }): Promise<SecretRecord>
+    remove(owner: string, name: string): Promise<boolean>
+}
+```
+
+## Encryption
+
+AES-256-GCM, a fresh 12-byte IV per write, stored as `iv:payload` in base64.
+GCM's authentication tag means an altered value fails to open rather than
+decrypting to something wrong — both cases are covered by tests.
+
+The key never leaves your process, and the package never writes it anywhere.
+
+> [!WARNING]
+> Losing the key loses every value stored under it. There is no recovery path,
+> by design. Back it up where you would back up a password.
+
+## API
+
+| | |
+| --- | --- |
+| `new Vault({ key, store, prefix? })` | Key is base64 or an imported `CryptoKey` |
+| `put(owner, name, value)` | Store or replace; returns a summary, no value |
+| `list(owner)` | Names and dates, sorted by name |
+| `open(owner, name)` | The plaintext — keep it in memory |
+| `has(owner, name)` | Whether it exists |
+| `remove(owner, name)` | `false` if there was nothing to remove |
+| `resolve(owner, values)` | Substitute `@vault:` references |
+| `generateKey()` | A new base64 key |
+
+Names are up to 64 characters of letters, numbers, dot, dash or underscore.
+Bad input throws `VaultError` (with a suggested HTTP `status`); key and
+ciphertext problems throw `VaultKeyError`.
+
+## Development
+
+```bash
+bun test
+bun run typecheck
+```

package/dist/crypto.d.ts

@@ -0,0 +1,7 @@
+/** A new random key, base64 encoded — store it somewhere safe. */
+export declare function generateKey(): string;
+/** Imports a base64 key produced by `generateKey`. */
+export declare function importKey(base64Key: string): Promise<CryptoKey>;
+export declare function seal(key: CryptoKey, plaintext: string): Promise<string>;
+export declare function open(key: CryptoKey, sealed: string): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAUA,kEAAkE;AAClE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,sDAAsD;AACtD,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAQrE;AAED,wBAAsB,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ7E;AAED,wBAAsB,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB1E"}

package/dist/errors.d.ts

@@ -0,0 +1,13 @@
+/** A caller mistake: a bad name, an empty value, a missing secret. */
+export declare class VaultError extends Error {
+    /** Suggested HTTP status, for callers putting this behind an API. */
+    readonly status: number;
+    constructor(message: string, 
+    /** Suggested HTTP status, for callers putting this behind an API. */
+    status?: number);
+}
+/** The key is the wrong shape, or cannot open what it was given. */
+export declare class VaultKeyError extends VaultError {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qBAAa,UAAW,SAAQ,KAAK;IAG7B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAFvB,OAAO,EAAE,MAAM;IACf,qEAAqE;IAC5D,MAAM,GAAE,MAAY;CAKpC;AAED,oEAAoE;AACpE,qBAAa,aAAc,SAAQ,UAAU;gBAC7B,OAAO,EAAE,MAAM;CAI9B"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./vault";
+export * from "./crypto";
+export * from "./errors";
+export * from "./stores/memory";
+export * from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,SAAS,CAAA"}

package/dist/index.js

@@ -0,0 +1,148 @@
+// src/errors.ts
+class VaultError extends Error {
+  status;
+  constructor(message, status = 422) {
+    super(message);
+    this.status = status;
+    this.name = "VaultError";
+  }
+}
+
+class VaultKeyError extends VaultError {
+  constructor(message) {
+    super(message, 500);
+    this.name = "VaultKeyError";
+  }
+}
+
+// src/crypto.ts
+var IV_BYTES = 12;
+var KEY_BYTES = 32;
+function generateKey() {
+  return Buffer.from(crypto.getRandomValues(new Uint8Array(KEY_BYTES))).toString("base64");
+}
+async function importKey(base64Key) {
+  const raw = Buffer.from(base64Key, "base64");
+  if (raw.length !== KEY_BYTES) {
+    throw new VaultKeyError(`A vault key must be ${KEY_BYTES} bytes, base64 encoded — got ${raw.length}.`);
+  }
+  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+async function seal(key, plaintext) {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const sealed = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
+  return `${Buffer.from(iv).toString("base64")}:${Buffer.from(sealed).toString("base64")}`;
+}
+async function open(key, sealed) {
+  const [iv, payload] = sealed.split(":");
+  if (!iv || !payload) {
+    throw new VaultKeyError("A sealed value must look like iv:payload.");
+  }
+  try {
+    const opened = await crypto.subtle.decrypt({ name: "AES-GCM", iv: Buffer.from(iv, "base64") }, key, Buffer.from(payload, "base64"));
+    return new TextDecoder().decode(opened);
+  } catch {
+    throw new VaultKeyError("That value could not be opened — wrong key, or it has been altered.");
+  }
+}
+
+// src/vault.ts
+var DEFAULT_PREFIX = "@vault:";
+var NAME_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/;
+
+class Vault {
+  key;
+  store;
+  prefix;
+  constructor({ key, store, prefix = DEFAULT_PREFIX }) {
+    this.key = typeof key === "string" ? importKey(key) : Promise.resolve(key);
+    this.store = store;
+    this.prefix = prefix;
+  }
+  async list(owner) {
+    const records = await this.store.list(owner);
+    return records.map(({ sealed: _sealed, ...summary }) => summary).sort((a, b) => a.name.localeCompare(b.name));
+  }
+  async put(owner, name, value) {
+    const clean = this.checkName(name);
+    if (!value)
+      throw new VaultError("A secret needs a value.");
+    const sealed = await seal(await this.key, value);
+    const { sealed: _sealed, ...summary } = await this.store.put({
+      owner,
+      name: clean,
+      sealed
+    });
+    return summary;
+  }
+  async has(owner, name) {
+    return await this.store.get(owner, this.checkName(name)) !== null;
+  }
+  remove(owner, name) {
+    return this.store.remove(owner, this.checkName(name));
+  }
+  async open(owner, name) {
+    const record = await this.store.get(owner, this.checkName(name));
+    if (!record)
+      throw new VaultError(`No secret named "${name}" in the vault.`, 404);
+    return open(await this.key, record.sealed);
+  }
+  async resolve(owner, values) {
+    const references = Object.entries(values).filter(([, value]) => value.startsWith(this.prefix));
+    if (references.length === 0)
+      return values;
+    const resolved = { ...values };
+    for (const [key, value] of references) {
+      resolved[key] = await this.open(owner, value.slice(this.prefix.length).trim());
+    }
+    return resolved;
+  }
+  checkName(name) {
+    const clean = String(name ?? "").trim();
+    if (!NAME_PATTERN.test(clean)) {
+      throw new VaultError("A name can be up to 64 characters: letters, numbers, dot, dash or underscore.");
+    }
+    return clean;
+  }
+}
+// src/stores/memory.ts
+class MemoryStore {
+  records = new Map;
+  static key(owner, name) {
+    return `${owner} ${name}`;
+  }
+  async get(owner, name) {
+    return this.records.get(MemoryStore.key(owner, name)) ?? null;
+  }
+  async list(owner) {
+    return [...this.records.values()].filter((record) => record.owner === owner);
+  }
+  async put(record) {
+    const key = MemoryStore.key(record.owner, record.name);
+    const now = new Date;
+    const stored = {
+      ...record,
+      createdAt: this.records.get(key)?.createdAt ?? now,
+      updatedAt: now
+    };
+    this.records.set(key, stored);
+    return stored;
+  }
+  async remove(owner, name) {
+    return this.records.delete(MemoryStore.key(owner, name));
+  }
+}
+export {
+  seal,
+  open,
+  importKey,
+  generateKey,
+  VaultKeyError,
+  VaultError,
+  Vault,
+  MemoryStore,
+  DEFAULT_PREFIX
+};
+
+//# debugId=593665718555ECE464756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/errors.ts", "../src/crypto.ts", "../src/vault.ts", "../src/stores/memory.ts"],
+  "sourcesContent": [
+    "/** A caller mistake: a bad name, an empty value, a missing secret. */\nexport class VaultError extends Error {\n    constructor(\n        message: string,\n        /** Suggested HTTP status, for callers putting this behind an API. */\n        readonly status: number = 422\n    ) {\n        super(message)\n        this.name = \"VaultError\"\n    }\n}\n\n/** The key is the wrong shape, or cannot open what it was given. */\nexport class VaultKeyError extends VaultError {\n    constructor(message: string) {\n        super(message, 500)\n        this.name = \"VaultKeyError\"\n    }\n}\n",
+    "import { VaultKeyError } from \"./errors\"\n\n/**\n * AES-256-GCM. Sealed values are `iv:payload`, both base64: the IV is fresh per\n * write, and GCM's tag means a tampered value fails to open rather than\n * decrypting to something wrong.\n */\nconst IV_BYTES = 12\nconst KEY_BYTES = 32\n\n/** A new random key, base64 encoded — store it somewhere safe. */\nexport function generateKey(): string {\n    return Buffer.from(crypto.getRandomValues(new Uint8Array(KEY_BYTES))).toString(\"base64\")\n}\n\n/** Imports a base64 key produced by `generateKey`. */\nexport async function importKey(base64Key: string): Promise<CryptoKey> {\n    const raw = Buffer.from(base64Key, \"base64\")\n    if (raw.length !== KEY_BYTES) {\n        throw new VaultKeyError(\n            `A vault key must be ${KEY_BYTES} bytes, base64 encoded — got ${raw.length}.`\n        )\n    }\n    return crypto.subtle.importKey(\"raw\", raw, \"AES-GCM\", false, [\"encrypt\", \"decrypt\"])\n}\n\nexport async function seal(key: CryptoKey, plaintext: string): Promise<string> {\n    const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES))\n    const sealed = await crypto.subtle.encrypt(\n        { name: \"AES-GCM\", iv },\n        key,\n        new TextEncoder().encode(plaintext)\n    )\n    return `${Buffer.from(iv).toString(\"base64\")}:${Buffer.from(sealed).toString(\"base64\")}`\n}\n\nexport async function open(key: CryptoKey, sealed: string): Promise<string> {\n    const [iv, payload] = sealed.split(\":\")\n    if (!iv || !payload) {\n        throw new VaultKeyError(\"A sealed value must look like iv:payload.\")\n    }\n\n    try {\n        const opened = await crypto.subtle.decrypt(\n            { name: \"AES-GCM\", iv: Buffer.from(iv, \"base64\") },\n            key,\n            Buffer.from(payload, \"base64\")\n        )\n        return new TextDecoder().decode(opened)\n    } catch {\n        throw new VaultKeyError(\n            \"That value could not be opened — wrong key, or it has been altered.\"\n        )\n    }\n}\n",
+    "import { importKey, open, seal } from \"./crypto\"\nimport { VaultError } from \"./errors\"\nimport type { SecretSummary, VaultStore } from \"./types\"\n\n/** How a stored value is referenced from configuration. */\nexport const DEFAULT_PREFIX = \"@vault:\"\n\nconst NAME_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/\n\nexport type VaultOptions = {\n    /** Base64 key from `generateKey()`, or an already imported CryptoKey. */\n    key: string | CryptoKey\n    store: VaultStore\n    /** Reference prefix, `@vault:` unless you say otherwise. */\n    prefix?: string\n}\n\n/**\n * A write-only credential store: values go in, and only `open` and `resolve`\n * take them out again. Listing never exposes a value, so a vault can back an\n * API without a reveal endpoint.\n */\nexport class Vault {\n    private readonly key: Promise<CryptoKey>\n    private readonly store: VaultStore\n    readonly prefix: string\n\n    constructor({ key, store, prefix = DEFAULT_PREFIX }: VaultOptions) {\n        this.key = typeof key === \"string\" ? importKey(key) : Promise.resolve(key)\n        this.store = store\n        this.prefix = prefix\n    }\n\n    /** Names and dates for one owner. Never values. */\n    async list(owner: string): Promise<SecretSummary[]> {\n        const records = await this.store.list(owner)\n        return records\n            .map(({ sealed: _sealed, ...summary }) => summary)\n            .sort((a, b) => a.name.localeCompare(b.name))\n    }\n\n    /** Stores a value, replacing whatever was under that name. */\n    async put(owner: string, name: string, value: string): Promise<SecretSummary> {\n        const clean = this.checkName(name)\n        if (!value) throw new VaultError(\"A secret needs a value.\")\n\n        const sealed = await seal(await this.key, value)\n        const { sealed: _sealed, ...summary } = await this.store.put({\n            owner,\n            name: clean,\n            sealed,\n        })\n        return summary\n    }\n\n    /** True when the owner has a secret under that name. */\n    async has(owner: string, name: string): Promise<boolean> {\n        return (await this.store.get(owner, this.checkName(name))) !== null\n    }\n\n    /** Removes a secret, returning false if it wasn't there. */\n    remove(owner: string, name: string): Promise<boolean> {\n        return this.store.remove(owner, this.checkName(name))\n    }\n\n    /**\n     * Reads one value back. The only way plaintext leaves the vault — keep it\n     * in memory and out of logs and responses.\n     */\n    async open(owner: string, name: string): Promise<string> {\n        const record = await this.store.get(owner, this.checkName(name))\n        if (!record) throw new VaultError(`No secret named \"${name}\" in the vault.`, 404)\n        return open(await this.key, record.sealed)\n    }\n\n    /**\n     * Substitutes `@vault:<name>` references in a set of values — an\n     * environment, a config object — leaving everything else alone.\n     *\n     * A reference to a secret that isn't there throws: running with a blank\n     * credential is worse than not running.\n     */\n    async resolve(\n        owner: string,\n        values: Record<string, string>\n    ): Promise<Record<string, string>> {\n        const references = Object.entries(values).filter(([, value]) =>\n            value.startsWith(this.prefix)\n        )\n        if (references.length === 0) return values\n\n        const resolved = { ...values }\n        for (const [key, value] of references) {\n            resolved[key] = await this.open(owner, value.slice(this.prefix.length).trim())\n        }\n        return resolved\n    }\n\n    private checkName(name: string): string {\n        const clean = String(name ?? \"\").trim()\n        if (!NAME_PATTERN.test(clean)) {\n            throw new VaultError(\n                \"A name can be up to 64 characters: letters, numbers, dot, dash or underscore.\"\n            )\n        }\n        return clean\n    }\n}\n",
+    "import type { SecretRecord, VaultStore } from \"../types\"\n\n/** Keeps sealed values in a Map. Handy for tests and short-lived processes. */\nexport class MemoryStore implements VaultStore {\n    private readonly records = new Map<string, SecretRecord>()\n\n    private static key(owner: string, name: string): string {\n        return `${owner} ${name}`\n    }\n\n    async get(owner: string, name: string): Promise<SecretRecord | null> {\n        return this.records.get(MemoryStore.key(owner, name)) ?? null\n    }\n\n    async list(owner: string): Promise<SecretRecord[]> {\n        return [...this.records.values()].filter((record) => record.owner === owner)\n    }\n\n    async put(record: {\n        owner: string\n        name: string\n        sealed: string\n    }): Promise<SecretRecord> {\n        const key = MemoryStore.key(record.owner, record.name)\n        const now = new Date()\n        const stored: SecretRecord = {\n            ...record,\n            // Replacing a value keeps the date it was first stored.\n            createdAt: this.records.get(key)?.createdAt ?? now,\n            updatedAt: now,\n        }\n        this.records.set(key, stored)\n        return stored\n    }\n\n    async remove(owner: string, name: string): Promise<boolean> {\n        return this.records.delete(MemoryStore.key(owner, name))\n    }\n}\n"
+  ],
+  "mappings": ";AACO,MAAM,mBAAmB,MAAM;AAAA,EAIrB;AAAA,EAHb,WAAW,CACP,SAES,SAAiB,KAC5B;AAAA,IACE,MAAM,OAAO;AAAA,IAFJ;AAAA,IAGT,KAAK,OAAO;AAAA;AAEpB;AAAA;AAGO,MAAM,sBAAsB,WAAW;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IACzB,MAAM,SAAS,GAAG;AAAA,IAClB,KAAK,OAAO;AAAA;AAEpB;;;ACXA,IAAM,WAAW;AACjB,IAAM,YAAY;AAGX,SAAS,WAAW,GAAW;AAAA,EAClC,OAAO,OAAO,KAAK,OAAO,gBAAgB,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,SAAS,QAAQ;AAAA;AAI3F,eAAsB,SAAS,CAAC,WAAuC;AAAA,EACnE,MAAM,MAAM,OAAO,KAAK,WAAW,QAAQ;AAAA,EAC3C,IAAI,IAAI,WAAW,WAAW;AAAA,IAC1B,MAAM,IAAI,cACN,uBAAuB,yCAAwC,IAAI,SACvE;AAAA,EACJ;AAAA,EACA,OAAO,OAAO,OAAO,UAAU,OAAO,KAAK,WAAW,OAAO,CAAC,WAAW,SAAS,CAAC;AAAA;AAGvF,eAAsB,IAAI,CAAC,KAAgB,WAAoC;AAAA,EAC3E,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,QAAQ,CAAC;AAAA,EAC1D,MAAM,SAAS,MAAM,OAAO,OAAO,QAC/B,EAAE,MAAM,WAAW,GAAG,GACtB,KACA,IAAI,YAAY,EAAE,OAAO,SAAS,CACtC;AAAA,EACA,OAAO,GAAG,OAAO,KAAK,EAAE,EAAE,SAAS,QAAQ,KAAK,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ;AAAA;AAGzF,eAAsB,IAAI,CAAC,KAAgB,QAAiC;AAAA,EACxE,OAAO,IAAI,WAAW,OAAO,MAAM,GAAG;AAAA,EACtC,IAAI,CAAC,MAAM,CAAC,SAAS;AAAA,IACjB,MAAM,IAAI,cAAc,2CAA2C;AAAA,EACvE;AAAA,EAEA,IAAI;AAAA,IACA,MAAM,SAAS,MAAM,OAAO,OAAO,QAC/B,EAAE,MAAM,WAAW,IAAI,OAAO,KAAK,IAAI,QAAQ,EAAE,GACjD,KACA,OAAO,KAAK,SAAS,QAAQ,CACjC;AAAA,IACA,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IACxC,MAAM;AAAA,IACJ,MAAM,IAAI,cACN,qEACJ;AAAA;AAAA;;;AC/CD,IAAM,iBAAiB;AAE9B,IAAM,eAAe;AAAA;AAed,MAAM,MAAM;AAAA,EACE;AAAA,EACA;AAAA,EACR;AAAA,EAET,WAAW,GAAG,KAAK,OAAO,SAAS,kBAAgC;AAAA,IAC/D,KAAK,MAAM,OAAO,QAAQ,WAAW,UAAU,GAAG,IAAI,QAAQ,QAAQ,GAAG;AAAA,IACzE,KAAK,QAAQ;AAAA,IACb,KAAK,SAAS;AAAA;AAAA,OAIZ,KAAI,CAAC,OAAyC;AAAA,IAChD,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK;AAAA,IAC3C,OAAO,QACF,IAAI,GAAG,QAAQ,YAAY,cAAc,OAAO,EAChD,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA,OAI9C,IAAG,CAAC,OAAe,MAAc,OAAuC;AAAA,IAC1E,MAAM,QAAQ,KAAK,UAAU,IAAI;AAAA,IACjC,IAAI,CAAC;AAAA,MAAO,MAAM,IAAI,WAAW,yBAAyB;AAAA,IAE1D,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,IAC/C,QAAQ,QAAQ,YAAY,YAAY,MAAM,KAAK,MAAM,IAAI;AAAA,MACzD;AAAA,MACA,MAAM;AAAA,MACN;AAAA,IACJ,CAAC;AAAA,IACD,OAAO;AAAA;AAAA,OAIL,IAAG,CAAC,OAAe,MAAgC;AAAA,IACrD,OAAQ,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC,MAAO;AAAA;AAAA,EAInE,MAAM,CAAC,OAAe,MAAgC;AAAA,IAClD,OAAO,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC;AAAA;AAAA,OAOlD,KAAI,CAAC,OAAe,MAA+B;AAAA,IACrD,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC;AAAA,IAC/D,IAAI,CAAC;AAAA,MAAQ,MAAM,IAAI,WAAW,oBAAoB,uBAAuB,GAAG;AAAA,IAChF,OAAO,KAAK,MAAM,KAAK,KAAK,OAAO,MAAM;AAAA;AAAA,OAUvC,QAAO,CACT,OACA,QAC+B;AAAA,IAC/B,MAAM,aAAa,OAAO,QAAQ,MAAM,EAAE,OAAO,IAAI,WACjD,MAAM,WAAW,KAAK,MAAM,CAChC;AAAA,IACA,IAAI,WAAW,WAAW;AAAA,MAAG,OAAO;AAAA,IAEpC,MAAM,WAAW,KAAK,OAAO;AAAA,IAC7B,YAAY,KAAK,UAAU,YAAY;AAAA,MACnC,SAAS,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM,KAAK,OAAO,MAAM,EAAE,KAAK,CAAC;AAAA,IACjF;AAAA,IACA,OAAO;AAAA;AAAA,EAGH,SAAS,CAAC,MAAsB;AAAA,IACpC,MAAM,QAAQ,OAAO,QAAQ,EAAE,EAAE,KAAK;AAAA,IACtC,IAAI,CAAC,aAAa,KAAK,KAAK,GAAG;AAAA,MAC3B,MAAM,IAAI,WACN,+EACJ;AAAA,IACJ;AAAA,IACA,OAAO;AAAA;AAEf;;ACxGO,MAAM,YAAkC;AAAA,EAC1B,UAAU,IAAI;AAAA,SAEhB,GAAG,CAAC,OAAe,MAAsB;AAAA,IACpD,OAAO,GAAG,SAAS;AAAA;AAAA,OAGjB,IAAG,CAAC,OAAe,MAA4C;AAAA,IACjE,OAAO,KAAK,QAAQ,IAAI,YAAY,IAAI,OAAO,IAAI,CAAC,KAAK;AAAA;AAAA,OAGvD,KAAI,CAAC,OAAwC;AAAA,IAC/C,OAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,OAAO,UAAU,KAAK;AAAA;AAAA,OAGzE,IAAG,CAAC,QAIgB;AAAA,IACtB,MAAM,MAAM,YAAY,IAAI,OAAO,OAAO,OAAO,IAAI;AAAA,IACrD,MAAM,MAAM,IAAI;AAAA,IAChB,MAAM,SAAuB;AAAA,SACtB;AAAA,MAEH,WAAW,KAAK,QAAQ,IAAI,GAAG,GAAG,aAAa;AAAA,MAC/C,WAAW;AAAA,IACf;AAAA,IACA,KAAK,QAAQ,IAAI,KAAK,MAAM;AAAA,IAC5B,OAAO;AAAA;AAAA,OAGL,OAAM,CAAC,OAAe,MAAgC;AAAA,IACxD,OAAO,KAAK,QAAQ,OAAO,YAAY,IAAI,OAAO,IAAI,CAAC;AAAA;AAE/D;",
+  "debugId": "593665718555ECE464756E2164756E21",
+  "names": []
+}

package/dist/stores/memory.d.ts

@@ -0,0 +1,15 @@
+import type { SecretRecord, VaultStore } from "../types";
+/** Keeps sealed values in a Map. Handy for tests and short-lived processes. */
+export declare class MemoryStore implements VaultStore {
+    private readonly records;
+    private static key;
+    get(owner: string, name: string): Promise<SecretRecord | null>;
+    list(owner: string): Promise<SecretRecord[]>;
+    put(record: {
+        owner: string;
+        name: string;
+        sealed: string;
+    }): Promise<SecretRecord>;
+    remove(owner: string, name: string): Promise<boolean>;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/stores/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAExD,+EAA+E;AAC/E,qBAAa,WAAY,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D,OAAO,CAAC,MAAM,CAAC,GAAG;IAIZ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAI9D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI5C,GAAG,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,YAAY,CAAC;IAanB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9D"}

package/dist/stores/memory.js

@@ -0,0 +1 @@
+export { MemoryStore } from "../index.js";

package/dist/stores/sqlite.d.ts

@@ -0,0 +1,23 @@
+import { Database } from "bun:sqlite";
+import type { SecretRecord, VaultStore } from "../types";
+/**
+ * Keeps sealed values in SQLite through `bun:sqlite`. Pass a file path,
+ * ":memory:", or a Database you already opened.
+ */
+export declare class SqliteStore implements VaultStore {
+    private readonly db;
+    private readonly table;
+    constructor(database?: string | Database, table?: string);
+    private static toRecord;
+    get(owner: string, name: string): Promise<SecretRecord | null>;
+    list(owner: string): Promise<SecretRecord[]>;
+    put(record: {
+        owner: string;
+        name: string;
+        sealed: string;
+    }): Promise<SecretRecord>;
+    remove(owner: string, name: string): Promise<boolean>;
+    /** Closes the underlying database. */
+    close(): void;
+}
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/stores/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/stores/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAUxD;;;GAGG;AACH,qBAAa,WAAY,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,QAAQ,GAAE,MAAM,GAAG,QAAqB,EAAE,KAAK,SAAkB;IAe7E,OAAO,CAAC,MAAM,CAAC,QAAQ;IAUjB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAS9D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAO5C,GAAG,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiBnB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS3D,sCAAsC;IACtC,KAAK,IAAI,IAAI;CAGhB"}

package/dist/stores/sqlite.js

@@ -0,0 +1,63 @@
+// @bun
+// src/stores/sqlite.ts
+import { Database } from "bun:sqlite";
+
+class SqliteStore {
+  db;
+  table;
+  constructor(database = ":memory:", table = "vault_secrets") {
+    this.db = typeof database === "string" ? new Database(database) : database;
+    this.table = table;
+    this.db.run(`CREATE TABLE IF NOT EXISTS ${this.table} (
+                owner TEXT NOT NULL,
+                name TEXT NOT NULL,
+                sealed TEXT NOT NULL,
+                created_at INTEGER NOT NULL,
+                updated_at INTEGER NOT NULL,
+                PRIMARY KEY (owner, name)
+            )`);
+  }
+  static toRecord(row) {
+    return {
+      owner: row.owner,
+      name: row.name,
+      sealed: row.sealed,
+      createdAt: new Date(row.created_at),
+      updatedAt: new Date(row.updated_at)
+    };
+  }
+  async get(owner, name) {
+    const row = this.db.query(`SELECT * FROM ${this.table} WHERE owner = ? AND name = ?`).get(owner, name);
+    return row ? SqliteStore.toRecord(row) : null;
+  }
+  async list(owner) {
+    return this.db.query(`SELECT * FROM ${this.table} WHERE owner = ?`).all(owner).map(SqliteStore.toRecord);
+  }
+  async put(record) {
+    const now = Date.now();
+    this.db.query(`INSERT INTO ${this.table} (owner, name, sealed, created_at, updated_at)
+                 VALUES (?, ?, ?, ?, ?)
+                 ON CONFLICT(owner, name)
+                 DO UPDATE SET sealed = excluded.sealed, updated_at = excluded.updated_at`).run(record.owner, record.name, record.sealed, now, now);
+    const stored = await this.get(record.owner, record.name);
+    if (!stored)
+      throw new Error("The secret vanished immediately after writing it.");
+    return stored;
+  }
+  async remove(owner, name) {
+    const existing = await this.get(owner, name);
+    if (!existing)
+      return false;
+    this.db.query(`DELETE FROM ${this.table} WHERE owner = ? AND name = ?`).run(owner, name);
+    return true;
+  }
+  close() {
+    this.db.close();
+  }
+}
+export {
+  SqliteStore
+};
+
+//# debugId=E8AE1F33B2C0F61864756E2164756E21
+//# sourceMappingURL=sqlite.js.map

package/dist/stores/sqlite.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../../src/stores/sqlite.ts"],
+  "sourcesContent": [
+    "import { Database } from \"bun:sqlite\"\nimport type { SecretRecord, VaultStore } from \"../types\"\n\ntype Row = {\n    owner: string\n    name: string\n    sealed: string\n    created_at: number\n    updated_at: number\n}\n\n/**\n * Keeps sealed values in SQLite through `bun:sqlite`. Pass a file path,\n * \":memory:\", or a Database you already opened.\n */\nexport class SqliteStore implements VaultStore {\n    private readonly db: Database\n    private readonly table: string\n\n    constructor(database: string | Database = \":memory:\", table = \"vault_secrets\") {\n        this.db = typeof database === \"string\" ? new Database(database) : database\n        this.table = table\n        this.db.run(\n            `CREATE TABLE IF NOT EXISTS ${this.table} (\n                owner TEXT NOT NULL,\n                name TEXT NOT NULL,\n                sealed TEXT NOT NULL,\n                created_at INTEGER NOT NULL,\n                updated_at INTEGER NOT NULL,\n                PRIMARY KEY (owner, name)\n            )`\n        )\n    }\n\n    private static toRecord(row: Row): SecretRecord {\n        return {\n            owner: row.owner,\n            name: row.name,\n            sealed: row.sealed,\n            createdAt: new Date(row.created_at),\n            updatedAt: new Date(row.updated_at),\n        }\n    }\n\n    async get(owner: string, name: string): Promise<SecretRecord | null> {\n        const row = this.db\n            .query<Row, [string, string]>(\n                `SELECT * FROM ${this.table} WHERE owner = ? AND name = ?`\n            )\n            .get(owner, name)\n        return row ? SqliteStore.toRecord(row) : null\n    }\n\n    async list(owner: string): Promise<SecretRecord[]> {\n        return this.db\n            .query<Row, [string]>(`SELECT * FROM ${this.table} WHERE owner = ?`)\n            .all(owner)\n            .map(SqliteStore.toRecord)\n    }\n\n    async put(record: {\n        owner: string\n        name: string\n        sealed: string\n    }): Promise<SecretRecord> {\n        const now = Date.now()\n        // Replacing a value keeps the row's original created_at.\n        this.db\n            .query(\n                `INSERT INTO ${this.table} (owner, name, sealed, created_at, updated_at)\n                 VALUES (?, ?, ?, ?, ?)\n                 ON CONFLICT(owner, name)\n                 DO UPDATE SET sealed = excluded.sealed, updated_at = excluded.updated_at`\n            )\n            .run(record.owner, record.name, record.sealed, now, now)\n\n        const stored = await this.get(record.owner, record.name)\n        if (!stored) throw new Error(\"The secret vanished immediately after writing it.\")\n        return stored\n    }\n\n    async remove(owner: string, name: string): Promise<boolean> {\n        const existing = await this.get(owner, name)\n        if (!existing) return false\n        this.db\n            .query(`DELETE FROM ${this.table} WHERE owner = ? AND name = ?`)\n            .run(owner, name)\n        return true\n    }\n\n    /** Closes the underlying database. */\n    close(): void {\n        this.db.close()\n    }\n}\n"
+  ],
+  "mappings": ";;AAAA;AAAA;AAeO,MAAM,YAAkC;AAAA,EAC1B;AAAA,EACA;AAAA,EAEjB,WAAW,CAAC,WAA8B,YAAY,QAAQ,iBAAiB;AAAA,IAC3E,KAAK,KAAK,OAAO,aAAa,WAAW,IAAI,SAAS,QAAQ,IAAI;AAAA,IAClE,KAAK,QAAQ;AAAA,IACb,KAAK,GAAG,IACJ,8BAA8B,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQvC;AAAA;AAAA,SAGW,QAAQ,CAAC,KAAwB;AAAA,IAC5C,OAAO;AAAA,MACH,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,MAClC,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,IACtC;AAAA;AAAA,OAGE,IAAG,CAAC,OAAe,MAA4C;AAAA,IACjE,MAAM,MAAM,KAAK,GACZ,MACG,iBAAiB,KAAK,oCAC1B,EACC,IAAI,OAAO,IAAI;AAAA,IACpB,OAAO,MAAM,YAAY,SAAS,GAAG,IAAI;AAAA;AAAA,OAGvC,KAAI,CAAC,OAAwC;AAAA,IAC/C,OAAO,KAAK,GACP,MAAqB,iBAAiB,KAAK,uBAAuB,EAClE,IAAI,KAAK,EACT,IAAI,YAAY,QAAQ;AAAA;AAAA,OAG3B,IAAG,CAAC,QAIgB;AAAA,IACtB,MAAM,MAAM,KAAK,IAAI;AAAA,IAErB,KAAK,GACA,MACG,eAAe,KAAK;AAAA;AAAA;AAAA,0FAIxB,EACC,IAAI,OAAO,OAAO,OAAO,MAAM,OAAO,QAAQ,KAAK,GAAG;AAAA,IAE3D,MAAM,SAAS,MAAM,KAAK,IAAI,OAAO,OAAO,OAAO,IAAI;AAAA,IACvD,IAAI,CAAC;AAAA,MAAQ,MAAM,IAAI,MAAM,mDAAmD;AAAA,IAChF,OAAO;AAAA;AAAA,OAGL,OAAM,CAAC,OAAe,MAAgC;AAAA,IACxD,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;AAAA,IAC3C,IAAI,CAAC;AAAA,MAAU,OAAO;AAAA,IACtB,KAAK,GACA,MAAM,eAAe,KAAK,oCAAoC,EAC9D,IAAI,OAAO,IAAI;AAAA,IACpB,OAAO;AAAA;AAAA,EAIX,KAAK,GAAS;AAAA,IACV,KAAK,GAAG,MAAM;AAAA;AAEtB;",
+  "debugId": "E8AE1F33B2C0F61864756E2164756E21",
+  "names": []
+}

package/dist/types.d.ts

@@ -0,0 +1,29 @@
+/** A stored secret, as the store keeps it. */
+export type SecretRecord = {
+    owner: string;
+    name: string;
+    /** Sealed value, `iv:payload`. Never the plaintext. */
+    sealed: string;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/** A stored secret, as callers are allowed to see it: no value. */
+export type SecretSummary = Omit<SecretRecord, "sealed">;
+/**
+ * Where sealed values live. Implement this to keep secrets in whatever database
+ * you already run; `MemoryStore` and `SqliteStore` ship with the package.
+ *
+ * Every method is scoped by `owner`, so one store serves many accounts.
+ */
+export type VaultStore = {
+    get(owner: string, name: string): Promise<SecretRecord | null>;
+    list(owner: string): Promise<SecretRecord[]>;
+    /** Insert or replace, returning what was stored. */
+    put(record: {
+        owner: string;
+        name: string;
+        sealed: string;
+    }): Promise<SecretRecord>;
+    remove(owner: string, name: string): Promise<boolean>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GAAG;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;AAExD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACrB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC9D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC5C,oDAAoD;IACpD,GAAG,CAAC,MAAM,EAAE;QACR,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD,CAAA"}

package/dist/vault.d.ts

@@ -0,0 +1,44 @@
+import type { SecretSummary, VaultStore } from "./types";
+/** How a stored value is referenced from configuration. */
+export declare const DEFAULT_PREFIX = "@vault:";
+export type VaultOptions = {
+    /** Base64 key from `generateKey()`, or an already imported CryptoKey. */
+    key: string | CryptoKey;
+    store: VaultStore;
+    /** Reference prefix, `@vault:` unless you say otherwise. */
+    prefix?: string;
+};
+/**
+ * A write-only credential store: values go in, and only `open` and `resolve`
+ * take them out again. Listing never exposes a value, so a vault can back an
+ * API without a reveal endpoint.
+ */
+export declare class Vault {
+    private readonly key;
+    private readonly store;
+    readonly prefix: string;
+    constructor({ key, store, prefix }: VaultOptions);
+    /** Names and dates for one owner. Never values. */
+    list(owner: string): Promise<SecretSummary[]>;
+    /** Stores a value, replacing whatever was under that name. */
+    put(owner: string, name: string, value: string): Promise<SecretSummary>;
+    /** True when the owner has a secret under that name. */
+    has(owner: string, name: string): Promise<boolean>;
+    /** Removes a secret, returning false if it wasn't there. */
+    remove(owner: string, name: string): Promise<boolean>;
+    /**
+     * Reads one value back. The only way plaintext leaves the vault — keep it
+     * in memory and out of logs and responses.
+     */
+    open(owner: string, name: string): Promise<string>;
+    /**
+     * Substitutes `@vault:<name>` references in a set of values — an
+     * environment, a config object — leaving everything else alone.
+     *
+     * A reference to a secret that isn't there throws: running with a blank
+     * credential is worse than not running.
+     */
+    resolve(owner: string, values: Record<string, string>): Promise<Record<string, string>>;
+    private checkName;
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAExD,2DAA2D;AAC3D,eAAO,MAAM,cAAc,YAAY,CAAA;AAIvC,MAAM,MAAM,YAAY,GAAG;IACvB,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,UAAU,CAAA;IACjB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,qBAAa,KAAK;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,EAAE,GAAG,EAAE,KAAK,EAAE,MAAuB,EAAE,EAAE,YAAY;IAMjE,mDAAmD;IAC7C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAOnD,8DAA8D;IACxD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAa7E,wDAAwD;IAClD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,4DAA4D;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMxD;;;;;;OAMG;IACG,OAAO,CACT,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAalC,OAAO,CAAC,SAAS;CASpB"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@mstone6969/vault",
+  "version": "0.1.0",
+  "description": "A write-only credential vault: AES-256-GCM at rest, per-owner scoping, and @vault: references resolved at use.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Malcolmston",
+  "keywords": [
+    "vault",
+    "secrets",
+    "credentials",
+    "encryption",
+    "aes-gcm",
+    "bun"
+  ],
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./stores/memory": {
+      "types": "./dist/stores/memory.d.ts",
+      "import": "./dist/stores/memory.js"
+    },
+    "./stores/sqlite": {
+      "types": "./dist/stores/sqlite.d.ts",
+      "import": "./dist/stores/sqlite.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "bun run build.ts",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run typecheck && bun test && bun run build"
+  },
+  "devDependencies": {
+    "@types/bun": "latest"
+  },
+  "peerDependencies": {
+    "typescript": "^5"
+  },
+  "peerDependenciesMeta": {
+    "typescript": {
+      "optional": true
+    }
+  }
+}