@mstone6969/vault 0.2.0 → 0.5.0

package/dist/vault.d.ts

@@ -1,24 +1,266 @@
-import type { SecretSummary, VaultStore } from "./types";
-/** How a stored value is referenced from configuration. */
+import { type KeyProvider } from "./providers";
+import type { PutOptions, SecretSummary, VaultEvent, VaultStore } from "./types";
+/**
+ * How a stored value is referenced from configuration.
+ *
+ * @remarks
+ * {@link Vault.resolve} substitutes any value that starts with this. Give a
+ * vault its own {@link VaultOptions.prefix} when `@vault:` already means
+ * something else in the configuration you are resolving.
+ *
+ * @defaultValue `"@vault:"`
+ */
 export declare const DEFAULT_PREFIX = "@vault:";
+/**
+ * How many previous values an entry keeps, unless you say otherwise.
+ *
+ * @remarks
+ * Only {@link Vault.rotate} adds to history, so this is how many superseded
+ * values {@link Vault.versions} can still hand back.
+ *
+ * @defaultValue 5
+ * @see {@link VaultOptions.historyLimit}
+ */
+export declare const DEFAULT_HISTORY_LIMIT = 5;
+/**
+ * What a random rotation draws from unless the policy says otherwise.
+ *
+ * @remarks
+ * Letters and digits only, so a generated value survives being pasted into a
+ * shell command or a connection string without quoting. Set
+ * {@link RotationPolicy.alphabet} for anything narrower or wider.
+ *
+ * @defaultValue A-Z, a-z and 0-9: 62 characters
+ * @see {@link randomValue}
+ */
+export declare const DEFAULT_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/**
+ * Everything a generator is told: which entry is being rotated and the
+ * non-secret arguments its policy carries. Deliberately not the current value —
+ * a generator that needs it can ask the vault for it.
+ *
+ * @see {@link Generator}, {@link RotationPolicy.arguments}
+ */
+export type RotationContext = {
+    /** Whose entry is being rotated. */
+    owner: string;
+    /** Which entry is being rotated. */
+    name: string;
+    /** The non-secret arguments its policy carries. */
+    arguments: Record<string, string>;
+};
+/**
+ * Produces the next value for an entry whose policy names it.
+ *
+ * @remarks
+ * Registered under a name in {@link VaultOptions.generators} and asked for by
+ * {@link RotationPolicy.generator}. Use one where the vault cannot invent the
+ * value itself — a key only the far end can mint, or a password that has to be
+ * set on a database before it means anything.
+ *
+ * @param context Which entry is being rotated and its policy's arguments. Not
+ *   the value being replaced.
+ * @returns The next value, or a promise of it.
+ *
+ * @example Minting a key at the provider that issues it
+ * ```ts
+ * const vault = new Vault({
+ *     key: generateKey(),
+ *     store: new MemoryStore(),
+ *     generators: {
+ *         provider: async ({ arguments: args }) => mintKeyFor(args.account),
+ *     },
+ * })
+ *
+ * await vault.put("alice", "api", "old-key", {
+ *     rotation: {
+ *         kind: "generator",
+ *         generator: "provider",
+ *         arguments: { account: "acct_123" },
+ *     },
+ * })
+ * await vault.rotate("alice", "api")
+ * ```
+ */
+export type Generator = (context: RotationContext) => Promise<string> | string;
+/**
+ * A random string of `length` characters drawn from `alphabet`.
+ *
+ * Sampling is rejected rather than folded with `%`, so every character is
+ * equally likely however odd the alphabet's length.
+ *
+ * @param length How many characters to produce. Defaults to 32.
+ * @param alphabet The characters to draw from. Defaults to
+ *   {@link DEFAULT_ALPHABET}.
+ * @returns A fresh string of exactly `length` characters.
+ * @throws {@link VaultError} 422 when `length` is below one, or `alphabet` has
+ *   fewer than two characters — neither can produce anything unguessable.
+ *
+ * @example
+ * ```ts
+ * randomValue()                        // 32 characters of A-Z, a-z, 0-9
+ * randomValue(16, "0123456789abcdef")  // 16 hex characters
+ * ```
+ *
+ * @see {@link RotationPolicy} to have the vault call this during a rotation.
+ */
+export declare function randomValue(length?: number, alphabet?: string): string;
+/**
+ * Everything a {@link Vault} is built from.
+ *
+ * @example
+ * ```ts
+ * import { Vault, MemoryStore, envKey } from "@mstone6969/vault"
+ *
+ * const vault = new Vault({
+ *     key: envKey("VAULT_KEY"),
+ *     store: new MemoryStore(),
+ *     historyLimit: 2,
+ *     onAccess: (event) => console.log(event.action, event.owner, event.name),
+ * })
+ * ```
+ */
 export type VaultOptions = {
-    /** Base64 key from `generateKey()`, or an already imported CryptoKey. */
-    key: string | CryptoKey;
+    /** The master key: base64, already imported, or a provider that finds one. */
+    key: string | CryptoKey | KeyProvider;
+    /** Where records are kept. */
     store: VaultStore;
-    /** Reference prefix, `@vault:` unless you say otherwise. */
+    /**
+     * Reference prefix, `@vault:` unless you say otherwise.
+     *
+     * @defaultValue {@link DEFAULT_PREFIX}
+     */
     prefix?: string;
+    /**
+     * Keys this vault will still open values with, but never seal under.
+     *
+     * Keep the old key here while a `rekey` is in flight, or after one that did
+     * not finish: values left under it stay readable instead of becoming
+     * unopenable the moment the primary key changes.
+     *
+     * @defaultValue none
+     * @see {@link Vault.rekey}
+     */
+    previousKeys?: (string | CryptoKey | KeyProvider)[];
+    /**
+     * How many previous values `rotate` keeps.
+     *
+     * @defaultValue {@link DEFAULT_HISTORY_LIMIT}
+     */
+    historyLimit?: number;
+    /**
+     * Functions that mint new values, by the name a rotation policy uses.
+     *
+     * The vault stores the *name*, never the function — so what is written down
+     * is that an entry can be rotated, not how to impersonate the thing that
+     * rotates it.
+     *
+     * @defaultValue none, so a `generator` policy fails with 501
+     */
+    generators?: Record<string, Generator>;
+    /**
+     * Called after everything the vault does, for an audit trail. It is never
+     * awaited and its failures are ignored — logging must not break a vault.
+     *
+     * @see {@link VaultEvent} for what it is told, including the refusals,
+     *   which arrive as `denied` with a `detail` saying which rule was hit.
+     */
+    onAccess?: (event: VaultEvent) => void;
+};
+/**
+ * What a `rekey` did, and to what it could not do it.
+ *
+ * @see {@link Vault.rekey}
+ */
+export type RekeyReport = {
+    /** How many entries were re-sealed under the new key. */
+    rekeyed: number;
+    /** Entries that would not open, by `owner/name`, left exactly as they were. */
+    failed: string[];
 };
 /**
- * A write-only credential store: values go in, and only `open` and `resolve`
- * take them out again. Listing never exposes a value, so a vault can back an
- * API without a reveal endpoint.
+ * A write-only credential store: values go in, and only `open`, `read` and
+ * `resolve` take them out again.
+ *
+ * Every value is sealed under its own data key, and only that key is sealed
+ * under the master key. Changing the master key therefore re-seals a handful of
+ * bytes per entry rather than every value, and one exposed data key exposes one
+ * value rather than all of them.
+ *
+ * @example Storing a credential and handing it to the thing that needs it
+ * ```ts
+ * import { Vault, MemoryStore, generateKey } from "@mstone6969/vault"
+ *
+ * const vault = new Vault({ key: generateKey(), store: new MemoryStore() })
+ *
+ * await vault.put("alice", "stripe_key", "sk_live_x", {
+ *     metadata: { kind: "api" },
+ * })
+ *
+ * // Nothing but open, read and resolve gets the value back out.
+ * await vault.list("alice")   // name, metadata, dates — no value
+ * await vault.open("alice", "stripe_key")
+ * await vault.resolve("alice", { STRIPE_KEY: "@vault:stripe_key" })
+ * ```
+ *
+ * @see {@link VaultOptions} for what it is built from, {@link VaultStore} for
+ *   where the records go, and {@link VaultError} for what it throws.
  */
 export declare class Vault {
-    private readonly key;
+    private keySource;
+    private previousSources;
+    /** Resolved on first use, not at construction: a provider may need to wait,
+     * or fail, and a vault nobody uses should do neither. */
+    private keyCache;
+    private previousCache;
     private readonly store;
+    private readonly historyLimit;
+    private readonly generators;
+    private readonly onAccess;
+    /** The prefix {@link Vault.resolve} treats as a reference. */
     readonly prefix: string;
-    constructor({ key, store, prefix }: VaultOptions);
-    /** Names and dates for one owner. Never values. */
+    /**
+     * @param options The key, the store and the policies this vault applies.
+     *   Nothing is contacted here: the key is resolved on first use, so a vault
+     *   built from a provider that is slow or unreachable costs nothing until
+     *   something asks it for a value.
+     */
+    constructor({ key, store, prefix, previousKeys, historyLimit, generators, onAccess, }: VaultOptions);
+    private master;
+    private retired;
+    private record;
+    /** Opens something with the master key, falling back to retired ones. */
+    private unsealWithMaster;
+    /** Opens a value: its data key first, then the value under that key. */
+    private unseal;
+    /** Seals a value under a fresh data key, and that key under the master. */
+    private enseal;
+    private checkName;
+    /**
+     * Everything an owner holds, sorted by name. Never a sealed value.
+     *
+     * @param owner Whose entries to list.
+     * @returns One summary per entry, in name order. A sealed value is absent
+     *   entirely; an entry stored in the open carries its value in `value`.
+     *
+     * @remarks
+     * Expiry hides nothing here: an entry past its `expiresAt` is still listed,
+     * and still refuses to open, until {@link Vault.purgeExpired} clears it.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "stripe_key", "sk_live_x", {
+     *     metadata: { kind: "api" },
+     * })
+     *
+     * const [entry] = await vault.list("alice")
+     * entry.name      // "stripe_key"
+     * entry.metadata  // { kind: "api" }
+     * entry.versions  // 0
+     * ```
+     *
+     * @see {@link SecretSummary}
+     */
     list(owner: string): Promise<SecretSummary[]>;
     /**
      * Stores a value, replacing whatever was under that name.
@@ -26,25 +268,318 @@ export declare class Vault {
      * `metadata` is kept in the clear and comes back from `list`, so it must
      * hold nothing secret — a credential's kind, or the username it belongs to,
      * not the password.
+     *
+     * @param owner Whose entry it is. Owners never see each other's entries.
+     * @param name What to call it: 1-64 characters of letters, numbers, dot,
+     *   dash or underscore. Surrounding whitespace is trimmed.
+     * @param value The value to store.
+     * @param options Metadata, expiry, rotation policy, and whether the entry
+     *   is sealed, final, or keeps what it replaces. An option left out is
+     *   inherited from the existing entry.
+     * @returns The stored entry, summarised — never its sealed value.
+     * @throws {@link VaultError} 422 when the name is not 1-64 characters of
+     *   letters, numbers, dot, dash or underscore, or the value is empty.
+     * @throws {@link VaultError} 409 when the entry is already there and
+     *   `final`: it can be deleted, never replaced.
+     *
+     * @example Replacing a value without restating what the entry is
+     * ```ts
+     * await vault.put("alice", "db", "first-password", {
+     *     metadata: { kind: "login", username: "ada" },
+     *     rotation: { kind: "random", length: 24 },
+     * })
+     *
+     * // Still a login, still rotatable at 24 characters, still sealed.
+     * await vault.put("alice", "db", "second-password")
+     * ```
+     *
+     * @see {@link Vault.rotate} to replace a value and keep the old one,
+     *   {@link PutOptions} for the rest of the options.
+     */
+    put(owner: string, name: string, value: string, options?: PutOptions): Promise<SecretSummary>;
+    /**
+     * Replaces a value, keeping the one it replaces.
+     *
+     * Called without a value, the entry's rotation policy produces one — which
+     * is the point of storing a policy: whatever runs the rotation is told how
+     * to make the next password, never what the current one is.
+     *
+     * Previous values stay openable, so a job that read the credential moments
+     * before a rotation can still finish on what it was given.
+     *
+     * @param owner Whose entry to rotate.
+     * @param name The entry to rotate.
+     * @param value The new value. Left out, the entry's rotation policy makes
+     *   one.
+     * @param options As {@link Vault.put}, minus `keepHistory`: a rotation
+     *   always keeps what it replaced, up to {@link VaultOptions.historyLimit}.
+     * @returns The rotated entry, summarised, with `rotatedAt` stamped.
+     * @throws {@link VaultError} 404 when no value is given and there is no
+     *   such entry to take a policy from.
+     * @throws {@link VaultError} 410 when no value is given and the entry has
+     *   expired.
+     * @throws {@link VaultError} 422 when no value is given and the entry has
+     *   no rotation policy to make one with.
+     * @throws {@link VaultError} 501 when the policy names a generator this
+     *   vault was not constructed with.
+     * @throws {@link VaultError} 409 when the entry is final.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "db", "first-password", {
+     *     rotation: { kind: "random", length: 24 },
+     * })
+     *
+     * const rotated = await vault.rotate("alice", "db")
+     * rotated.rotatedAt                    // stamped just now
+     * await vault.versions("alice", "db")  // ["first-password"]
+     * ```
+     *
+     * @see {@link Vault.rotationDue} for which entries are asking for this.
+     */
+    rotate(owner: string, name: string, value?: string, options?: Omit<PutOptions, "keepHistory">): Promise<SecretSummary>;
+    /** The next value an entry's policy calls for. */
+    private generate;
+    /**
+     * Entries whose policy says how often they want rotating, and whose time
+     * has come. Nothing rotates them for you — schedule this and act on it.
+     *
+     * @param now The moment to judge against. Pass a later one to ask what will
+     *   be due by then.
+     * @returns Summaries of every entry, whoever owns it, whose
+     *   {@link RotationPolicy.every} seconds have passed since it was last
+     *   rotated — or since it was stored, if it never has been.
+     *
+     * @remarks
+     * One of the three calls that reach across owners, so it belongs to
+     * whatever runs the schedule rather than to a request.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "db", "x", {
+     *     rotation: { kind: "random", every: 86_400 },
+     * })
+     *
+     * for (const entry of await vault.rotationDue()) {
+     *     await vault.rotate(entry.owner, entry.name)
+     * }
+     * ```
+     */
+    rotationDue(now?: Date): Promise<SecretSummary[]>;
+    /**
+     * Previous values of an entry, newest first, opened.
+     *
+     * @param owner Whose entry it is.
+     * @param name The entry to look back through.
+     * @returns The values it used to hold, newest first, in the clear. Empty
+     *   for an entry that has never been rotated.
+     * @throws {@link VaultError} 404 when there is no such entry.
+     * @throws {@link VaultError} 410 when the entry has expired.
+     * @throws {@link VaultError} 422 when the name is not a legal one.
+     * @throws {@link VaultKeyError} 500 when a kept value will not open under
+     *   the master key or any of {@link VaultOptions.previousKeys}.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "deploy", "v1")
+     * await vault.rotate("alice", "deploy", "v2")
+     * await vault.rotate("alice", "deploy", "v3")
+     *
+     * await vault.versions("alice", "deploy")  // ["v2", "v1"]
+     * ```
+     */
+    versions(owner: string, name: string): Promise<string[]>;
+    /**
+     * True when the owner has a secret under that name, expired or not.
+     *
+     * @param owner Whose entry to look for.
+     * @param name The name to look for.
+     * @returns Whether a record exists under it.
+     * @throws {@link VaultError} 422 when the name is not a legal one.
+     *
+     * @remarks
+     * Opens nothing and is not stopped by expiry, so it answers "is this name
+     * taken" rather than "can this value still be used".
      */
-    put(owner: string, name: string, value: string, metadata?: Record<string, string>): Promise<SecretSummary>;
-    /** True when the owner has a secret under that name. */
     has(owner: string, name: string): Promise<boolean>;
-    /** Removes a secret, returning false if it wasn't there. */
+    /**
+     * Removes a secret, returning false if it wasn't there.
+     *
+     * @param owner Whose entry to delete.
+     * @param name The entry to delete.
+     * @returns True when something was deleted, false when there was nothing
+     *   under that name.
+     * @throws {@link VaultError} 422 when the name is not a legal one.
+     *
+     * @remarks
+     * Deleting takes the kept previous values with it, and it is the one thing
+     * a `final` entry allows.
+     */
     remove(owner: string, name: string): Promise<boolean>;
+    private require;
     /**
-     * Reads one value back. The only way plaintext leaves the vault — keep it
-     * in memory and out of logs and responses.
+     * Reads one value back. The only way plaintext leaves a sealed entry — keep
+     * it in memory and out of logs and responses.
+     *
+     * @param owner Whose entry to open.
+     * @param name The entry to open.
+     * @returns The value, sealed or not.
+     * @throws {@link VaultError} 404 when there is no such entry.
+     * @throws {@link VaultError} 410 when the entry has expired. The record is
+     *   still there; it just cannot be used.
+     * @throws {@link VaultError} 422 when the name is not a legal one.
+     * @throws {@link VaultKeyError} 500 when the value will not open under the
+     *   master key or any of {@link VaultOptions.previousKeys} — a wrong key or
+     *   an altered value, which GCM cannot tell apart.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "token", "shhh")
+     * await vault.open("alice", "token")  // "shhh"
+     * ```
+     *
+     * @see {@link Vault.read} for entries stored in the open,
+     *   {@link Vault.resolve} for substituting several at once.
      */
     open(owner: string, name: string): Promise<string>;
+    /**
+     * Reads an entry stored in the open. A sealed one refuses.
+     *
+     * @param owner Whose entry to read.
+     * @param name The entry to read.
+     * @returns The value, which was stored with `open: true` and was therefore
+     *   never secret.
+     * @throws {@link VaultError} 403 when the entry is sealed.
+     *   {@link Vault.open} is the only way a sealed value comes out.
+     * @throws {@link VaultError} 404 when there is no such entry.
+     * @throws {@link VaultError} 410 when the entry has expired.
+     * @throws {@link VaultError} 422 when the name is not a legal one.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "region", "eu-west-1", { open: true })
+     * await vault.read("alice", "region")  // "eu-west-1"
+     *
+     * await vault.put("alice", "token", "shhh")
+     * await vault.read("alice", "token")   // throws: 403, sealed
+     * ```
+     */
+    read(owner: string, name: string): Promise<string>;
     /**
      * Substitutes `@vault:<name>` references in a set of values — an
      * environment, a config object — leaving everything else alone.
      *
-     * A reference to a secret that isn't there throws: running with a blank
-     * credential is worse than not running.
+     * A reference to a secret that isn't there, or that has expired, throws:
+     * running with a blank credential is worse than not running.
+     *
+     * @param owner Whose entries the references name.
+     * @param values The set to substitute into. Not modified.
+     * @returns A copy with every reference replaced by its value, or the same
+     *   object back when nothing in it is a reference.
+     * @throws {@link VaultError} 404 when a reference names no entry.
+     * @throws {@link VaultError} 410 when a referenced entry has expired.
+     * @throws {@link VaultError} 422 when what follows the prefix is not a
+     *   legal name.
+     *
+     * @remarks
+     * Whitespace around the name is ignored, so `"@vault: token "` finds
+     * `token`. Sealed and open entries both resolve; the prefix comes from
+     * {@link Vault.prefix}.
+     *
+     * @example Filling in an environment before spawning something
+     * ```ts
+     * await vault.put("alice", "token", "secret")
+     *
+     * await vault.resolve("alice", {
+     *     PLAIN: "kept",
+     *     API_TOKEN: "@vault:token",
+     * })
+     * // { PLAIN: "kept", API_TOKEN: "secret" }
+     * ```
      */
     resolve(owner: string, values: Record<string, string>): Promise<Record<string, string>>;
-    private checkName;
+    /**
+     * Re-seals values under fresh data keys, without changing the master key.
+     *
+     * Cheap hygiene: the ciphertext of an unchanged secret stops being
+     * comparable between two copies of the database taken at different times.
+     *
+     * @param owner Limit it to one owner's entries. Left out, it walks the
+     *   whole store, whoever owns it.
+     * @returns How many entries were re-sealed. Entries stored in the open hold
+     *   nothing to re-seal and are skipped.
+     * @throws {@link VaultKeyError} 500 when a value will not open. Unlike
+     *   {@link Vault.rekey} this stops there, having already re-sealed the
+     *   entries it got to — those are unharmed, since the key did not change.
+     *
+     * @example
+     * ```ts
+     * await vault.reseal("alice")  // just this owner
+     * await vault.reseal()         // the whole store
+     * ```
+     */
+    reseal(owner?: string): Promise<number>;
+    /**
+     * Re-seals every data key under a new master key.
+     *
+     * The old key is kept as a fallback for the rest of this vault's life, so a
+     * run that stops halfway leaves a mix that still opens. Construct the next
+     * vault with `key: next, previousKeys: [old]` until you are confident, then
+     * drop the old one.
+     *
+     * An entry that will not open is left untouched and named in the report,
+     * because re-sealing what you cannot read would only destroy it.
+     *
+     * @param next The new master key: base64, already imported, or a provider
+     *   that finds one.
+     * @returns How many entries moved, and which would not, by `owner/name`.
+     * @throws {@link VaultKeyError} 500 when `next` is not a usable key. It is
+     *   resolved before anything is written, so nothing has changed.
+     *
+     * @remarks
+     * Walks every owner, and changes this vault as it goes: from here on it
+     * seals under `next` and keeps the key it had as a fallback. An entry
+     * stored in the open holds no key and is skipped, and one written before
+     * envelope encryption is given a data key on the way past.
+     *
+     * @example
+     * ```ts
+     * const next = generateKey()
+     * const report = await vault.rekey(next)
+     * report.rekeyed  // 2
+     * report.failed   // ["alice/stranger"] — left exactly as they were
+     *
+     * // Until the failures are dealt with, keep the old key readable.
+     * const moved = new Vault({ key: next, store, previousKeys: [old] })
+     * ```
+     *
+     * @see {@link RekeyReport}, {@link VaultOptions.previousKeys}
+     */
+    rekey(next: string | CryptoKey | KeyProvider): Promise<RekeyReport>;
+    /** Moves an entry's kept values onto the new master key alongside it. */
+    private rekeyHistory;
+    /**
+     * Deletes entries whose time is up. Returns how many went.
+     *
+     * @param now The moment to judge against. Pass a later one to see what a
+     *   run then would take.
+     * @returns How many entries were deleted.
+     *
+     * @remarks
+     * Walks every owner. Expiry stops an entry being used, not being stored:
+     * until this runs, an expired entry is still there and still listed.
+     *
+     * @example
+     * ```ts
+     * await vault.put("alice", "temporary", "x", {
+     *     expiresAt: new Date(Date.now() - 1),
+     * })
+     *
+     * await vault.open("alice", "temporary")  // throws: 410, expired
+     * await vault.purgeExpired()              // 1
+     * await vault.has("alice", "temporary")   // false
+     * ```
+     */
+    purgeExpired(now?: Date): Promise<number>;
 }
 //# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAExD,2DAA2D;AAC3D,eAAO,MAAM,cAAc,YAAY,CAAA;AAIvC,MAAM,MAAM,YAAY,GAAG;IACvB,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,UAAU,CAAA;IACjB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,qBAAa,KAAK;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,EAAE,GAAG,EAAE,KAAK,EAAE,MAAuB,EAAE,EAAE,YAAY;IAMjE,mDAAmD;IAC7C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAOnD;;;;;;OAMG;IACG,GAAG,CACL,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACtC,OAAO,CAAC,aAAa,CAAC;IAczB,wDAAwD;IAClD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,4DAA4D;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMxD;;;;;;OAMG;IACG,OAAO,CACT,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAalC,OAAO,CAAC,SAAS;CASpB"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,KAAK,EACR,UAAU,EAGV,aAAa,EACb,UAAU,EACV,UAAU,EACb,MAAM,SAAS,CAAA;AAEhB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAAY,CAAA;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAItC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,mEACuC,CAAA;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,WAAW,CAAC,MAAM,SAAK,EAAE,QAAQ,SAAmB,GAAG,MAAM,CAiB5E;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG;IACvB,8EAA8E;IAC9E,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAA;IACrC,8BAA8B;IAC9B,KAAK,EAAE,UAAU,CAAA;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,EAAE,CAAA;IACnD;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACzC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IACtB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAA;IACf,+EAA+E;IAC/E,MAAM,EAAE,MAAM,EAAE,CAAA;CACnB,CAAA;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,KAAK;IACd,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,eAAe,CAAsC;IAC7D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IACpE,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IAEvB;;;;;OAKG;gBACS,EACR,GAAG,EACH,KAAK,EACL,MAAuB,EACvB,YAAiB,EACjB,YAAoC,EACpC,UAAe,EACf,QAAQ,GACX,EAAE,YAAY;IAUf,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,MAAM;IASd,yEAAyE;YAC3D,gBAAgB;IAe9B,wEAAwE;YAC1D,MAAM;IASpB,2EAA2E;YAC7D,MAAM;IASpB,OAAO,CAAC,SAAS;IAUjB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,GAAG,CACL,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,UAAe,GACzB,OAAO,CAAC,aAAa,CAAC;IA0DzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,MAAM,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,GAAE,IAAI,CAAC,UAAU,EAAE,aAAa,CAAM,GAC9C,OAAO,CAAC,aAAa,CAAC;IAazB,kDAAkD;YACpC,QAAQ;IAwBtB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,WAAW,CAAC,GAAG,OAAa,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAY7D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO9D;;;;;;;;;;;OAWG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD;;;;;;;;;;;;OAYG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAM7C,OAAO;IAgBrB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUxD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,OAAO,CACT,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAalC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAqDzE,yEAAyE;YAC3D,YAAY;IAa1B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,YAAY,CAAC,GAAG,OAAa,GAAG,OAAO,CAAC,MAAM,CAAC;CAOxD"}

package/docs/README.md

@@ -0,0 +1,10 @@
+**@mstone6969/vault**
+
+***
+
+# @mstone6969/vault
+
+## Modules
+
+- [index](index/README.md)
+- [stores/sqlite](stores/sqlite/README.md)

package/docs/index/README.md

@@ -0,0 +1,48 @@
+[**@mstone6969/vault**](../README.md)
+
+***
+
+[@mstone6969/vault](../README.md) / index
+
+# index
+
+## Classes
+
+- [VaultError](classes/VaultError.md)
+- [VaultKeyError](classes/VaultKeyError.md)
+- [FileStore](classes/FileStore.md)
+- [MemoryStore](classes/MemoryStore.md)
+- [Vault](classes/Vault.md)
+
+## Type Aliases
+
+- [KeyProvider](type-aliases/KeyProvider.md)
+- [HistoryEntry](type-aliases/HistoryEntry.md)
+- [RotationPolicy](type-aliases/RotationPolicy.md)
+- [SecretRecord](type-aliases/SecretRecord.md)
+- [SecretSummary](type-aliases/SecretSummary.md)
+- [PutOptions](type-aliases/PutOptions.md)
+- [VaultStore](type-aliases/VaultStore.md)
+- [VaultEvent](type-aliases/VaultEvent.md)
+- [RotationContext](type-aliases/RotationContext.md)
+- [Generator](type-aliases/Generator.md)
+- [VaultOptions](type-aliases/VaultOptions.md)
+- [RekeyReport](type-aliases/RekeyReport.md)
+
+## Variables
+
+- [DEFAULT\_PREFIX](variables/DEFAULT_PREFIX.md)
+- [DEFAULT\_HISTORY\_LIMIT](variables/DEFAULT_HISTORY_LIMIT.md)
+- [DEFAULT\_ALPHABET](variables/DEFAULT_ALPHABET.md)
+
+## Functions
+
+- [generateKey](functions/generateKey.md)
+- [importKey](functions/importKey.md)
+- [seal](functions/seal.md)
+- [open](functions/open.md)
+- [staticKey](functions/staticKey.md)
+- [envKey](functions/envKey.md)
+- [fileKey](functions/fileKey.md)
+- [isKeyProvider](functions/isKeyProvider.md)
+- [randomValue](functions/randomValue.md)