@nexus_js/security 0.7.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nexus Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,7 @@
+# @nexus_js/security
+
+**Vault-lite** — in-memory secrets with hot-reload (`nexusVault`, `ctx.secrets`).
+
+**Shield-lite** — build manifest helpers (`shield-manifest.json`, action name extraction).
+
+Used by `@nexus_js/server` and the CLI; no third-party services.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { NexusVault, nexusVault, getVaultSecretsMap, type VaultListener, } from './vault.js';
+export { SHIELD_MANIFEST_FILENAME, type ShieldManifestV1, parseShieldManifest, loadShieldManifestFromRoot, extractActionNamesFromActionsSource, collectActionNamesFromOutputDir, } from './shield.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { NexusVault, nexusVault, getVaultSecretsMap, } from './vault.js';
+export { SHIELD_MANIFEST_FILENAME, parseShieldManifest, loadShieldManifestFromRoot, extractActionNamesFromActionsSource, collectActionNamesFromOutputDir, } from './shield.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,kBAAkB,GAEnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EAExB,mBAAmB,EACnB,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,aAAa,CAAC"}

package/dist/shield.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Nexus Shield-lite — build-time manifest (routes + server action names) for request allowlists.
+ */
+export declare const SHIELD_MANIFEST_FILENAME = "shield-manifest.json";
+export interface ShieldManifestV1 {
+    version: 1;
+    routes: string[];
+    actions: string[];
+}
+export declare function parseShieldManifest(raw: string): ShieldManifestV1 | null;
+export declare function loadShieldManifestFromRoot(appRoot: string): ShieldManifestV1 | null;
+export declare function extractActionNamesFromActionsSource(source: string): string[];
+/** Scan .nexus/output for *.actions.js files (recursive). */
+export declare function collectActionNamesFromOutputDir(outDir: string): string[];
+//# sourceMappingURL=shield.d.ts.map

package/dist/shield.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.d.ts","sourceRoot":"","sources":["../src/shield.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAaxE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAOnF;AAKD,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ5E;AAsBD,6DAA6D;AAC7D,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAYxE"}

package/dist/shield.js

@@ -0,0 +1,83 @@
+/**
+ * Nexus Shield-lite — build-time manifest (routes + server action names) for request allowlists.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+export const SHIELD_MANIFEST_FILENAME = 'shield-manifest.json';
+export function parseShieldManifest(raw) {
+    try {
+        const o = JSON.parse(raw);
+        if (o.version !== 1)
+            return null;
+        if (!Array.isArray(o.routes) || !Array.isArray(o.actions))
+            return null;
+        return {
+            version: 1,
+            routes: o.routes.filter((x) => typeof x === 'string'),
+            actions: o.actions.filter((x) => typeof x === 'string'),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function loadShieldManifestFromRoot(appRoot) {
+    const p = join(appRoot, '.nexus', 'output', SHIELD_MANIFEST_FILENAME);
+    try {
+        return parseShieldManifest(readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Matches registerAction("name", …) in emitted sidecars (JSON.stringify always uses double quotes). */
+const RE_REGISTER_ACTION = /registerAction\s*\(\s*"([^"]+)"/g;
+export function extractActionNamesFromActionsSource(source) {
+    const out = [];
+    let m;
+    RE_REGISTER_ACTION.lastIndex = 0;
+    while ((m = RE_REGISTER_ACTION.exec(source)) !== null) {
+        out.push(m[1]);
+    }
+    return out;
+}
+function collectFilesRecursive(dir, match) {
+    const out = [];
+    if (!existsSync(dir))
+        return out;
+    function walk(d) {
+        for (const name of readdirSync(d)) {
+            const p = join(d, name);
+            let st;
+            try {
+                st = statSync(p);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory())
+                walk(p);
+            else if (match(name))
+                out.push(p);
+        }
+    }
+    walk(dir);
+    return out;
+}
+/** Scan .nexus/output for *.actions.js files (recursive). */
+export function collectActionNamesFromOutputDir(outDir) {
+    const names = new Set();
+    const files = collectFilesRecursive(outDir, (n) => n.endsWith('.actions.js'));
+    for (const p of files) {
+        try {
+            const src = readFileSync(p, 'utf-8');
+            for (const n of extractActionNamesFromActionsSource(src))
+                names.add(n);
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return [...names].sort();
+}
+//# sourceMappingURL=shield.js.map

package/dist/shield.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.js","sourceRoot":"","sources":["../src/shield.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAQ/D,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;QACvD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAE9D,MAAM,UAAU,mCAAmC,CAAC,MAAc;IAChE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,kBAAkB,CAAC,SAAS,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,KAAgC;IAC1E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,SAAS,IAAI,CAAC,CAAS;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACxB,IAAI,EAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;iBACzB,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/shield.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shield.test.d.ts.map

package/dist/shield.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.test.d.ts","sourceRoot":"","sources":["../src/shield.test.ts"],"names":[],"mappings":""}

package/dist/shield.test.js

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+import { collectActionNamesFromOutputDir, extractActionNamesFromActionsSource, parseShieldManifest, } from './shield.js';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+describe('parseShieldManifest', () => {
+    it('accepts v1', () => {
+        const m = parseShieldManifest(JSON.stringify({ version: 1, routes: ['/'], actions: ['a'] }));
+        expect(m).toEqual({ version: 1, routes: ['/'], actions: ['a'] });
+    });
+    it('rejects bad version', () => {
+        expect(parseShieldManifest(JSON.stringify({ version: 2, routes: [], actions: [] }))).toBeNull();
+    });
+});
+describe('extractActionNamesFromActionsSource', () => {
+    it('finds registerAction names', () => {
+        const src = `
+      import { registerAction } from '@nexus_js/server/actions';
+      registerAction("foo", fn);
+      registerAction("bar-baz", other);
+    `;
+        expect(extractActionNamesFromActionsSource(src)).toEqual(['foo', 'bar-baz']);
+    });
+});
+describe('collectActionNamesFromOutputDir', () => {
+    it('walks nested dirs', () => {
+        const root = mkdtempSync(join(tmpdir(), 'nexus-shield-'));
+        try {
+            const nested = join(root, 'blog');
+            mkdirSync(nested, { recursive: true });
+            writeFileSync(join(nested, 'post.actions.js'), 'registerAction("savePost", x); registerAction("deletePost", y);', 'utf-8');
+            expect(collectActionNamesFromOutputDir(root)).toEqual(['deletePost', 'savePost']);
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=shield.test.js.map

package/dist/shield.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.test.js","sourceRoot":"","sources":["../src/shield.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;QACpB,MAAM,CAAC,GAAG,mBAAmB,CAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAC9D,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,GAAG,GAAG;;;;KAIX,CAAC;QACF,MAAM,CAAC,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,aAAa,CACX,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC/B,iEAAiE,EACjE,OAAO,CACR,CAAC;YACF,MAAM,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/vault.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Nexus Vault-lite — in-memory secret store with hot-reload (no external vault service).
+ * Seed once from `process.env`, then merge patches from Studio / `POST /_nexus/dev/vault`.
+ */
+export type VaultListener = () => void;
+export declare class NexusVault {
+    private readonly store;
+    /**
+     * One-time copy of all string values from `process.env`.
+     * Call when the HTTP server starts so the baseline matches the container env.
+     */
+    seedFromProcessEnv(): void;
+    get(key: string): string | undefined;
+    has(key: string): boolean;
+    /**
+     * Merge keys. Use empty string to remove a key from the vault (not from `process.env` on disk).
+     */
+    patch(entries: Record<string, string>): void;
+    /**
+     * Reset to current `process.env`, then apply `entries` (empty string removes a key).
+     * Use from Studio “Replace all” to snap back to the process baseline and apply a full `.env`-style paste.
+     */
+    replaceAll(entries: Record<string, string>): void;
+    /** Snapshot for `NexusContext.secrets` (immutable view per request). */
+    snapshot(): ReadonlyMap<string, string>;
+    subscribe(fn: VaultListener): () => void;
+    private notify;
+}
+/** Process-wide vault instance — use this from server code. */
+export declare const nexusVault: NexusVault;
+export declare function getVaultSecretsMap(): ReadonlyMap<string, string>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC;AAIvC,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IAEnD;;;OAGG;IACH,kBAAkB,IAAI,IAAI;IAM1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAQ5C;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAUjD,wEAAwE;IACxE,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAIvC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,IAAI;IAOxC,OAAO,CAAC,MAAM;CASf;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,YAAmB,CAAC;AAE3C,wBAAgB,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhE"}

package/dist/vault.js

@@ -0,0 +1,77 @@
+/**
+ * Nexus Vault-lite — in-memory secret store with hot-reload (no external vault service).
+ * Seed once from `process.env`, then merge patches from Studio / `POST /_nexus/dev/vault`.
+ */
+const vaultListeners = new Set();
+export class NexusVault {
+    store = new Map();
+    /**
+     * One-time copy of all string values from `process.env`.
+     * Call when the HTTP server starts so the baseline matches the container env.
+     */
+    seedFromProcessEnv() {
+        for (const [k, v] of Object.entries(process.env)) {
+            if (typeof v === 'string')
+                this.store.set(k, v);
+        }
+    }
+    get(key) {
+        return this.store.get(key);
+    }
+    has(key) {
+        return this.store.has(key);
+    }
+    /**
+     * Merge keys. Use empty string to remove a key from the vault (not from `process.env` on disk).
+     */
+    patch(entries) {
+        for (const [k, v] of Object.entries(entries)) {
+            if (v === '')
+                this.store.delete(k);
+            else
+                this.store.set(k, v);
+        }
+        this.notify();
+    }
+    /**
+     * Reset to current `process.env`, then apply `entries` (empty string removes a key).
+     * Use from Studio “Replace all” to snap back to the process baseline and apply a full `.env`-style paste.
+     */
+    replaceAll(entries) {
+        this.store.clear();
+        this.seedFromProcessEnv();
+        for (const [k, v] of Object.entries(entries)) {
+            if (v === '')
+                this.store.delete(k);
+            else
+                this.store.set(k, v);
+        }
+        this.notify();
+    }
+    /** Snapshot for `NexusContext.secrets` (immutable view per request). */
+    snapshot() {
+        return new Map(this.store);
+    }
+    subscribe(fn) {
+        vaultListeners.add(fn);
+        return () => {
+            vaultListeners.delete(fn);
+        };
+    }
+    notify() {
+        for (const fn of vaultListeners) {
+            try {
+                fn();
+            }
+            catch {
+                /* ignore listener errors */
+            }
+        }
+    }
+}
+/** Process-wide vault instance — use this from server code. */
+export const nexusVault = new NexusVault();
+export function getVaultSecretsMap() {
+    return nexusVault.snapshot();
+}
+//# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiB,CAAC;AAEhD,MAAM,OAAO,UAAU;IACJ,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEnD;;;OAGG;IACH,kBAAkB;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAA+B;QACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;gBAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,OAA+B;QACxC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;gBAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,EAAiB;QACzB,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE;YACV,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC;IACJ,CAAC;IAEO,MAAM;QACZ,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,EAAE,EAAE,CAAC;YACP,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;AAE3C,MAAM,UAAU,kBAAkB;IAChC,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/vault.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vault.test.d.ts.map

package/dist/vault.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.test.d.ts","sourceRoot":"","sources":["../src/vault.test.ts"],"names":[],"mappings":""}

package/dist/vault.test.js

@@ -0,0 +1,40 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+import { NexusVault } from './vault.js';
+describe('NexusVault', () => {
+    const prev = { ...process.env };
+    beforeEach(() => {
+        process.env['TEST_VAULT_A'] = 'one';
+        process.env['TEST_VAULT_B'] = 'two';
+    });
+    afterEach(() => {
+        for (const k of Object.keys(process.env)) {
+            if (!(k in prev))
+                delete process.env[k];
+        }
+        for (const [k, v] of Object.entries(prev)) {
+            process.env[k] = v;
+        }
+    });
+    it('seeds from env and patches override', () => {
+        const v = new NexusVault();
+        v.seedFromProcessEnv();
+        expect(v.get('TEST_VAULT_A')).toBe('one');
+        v.patch({ TEST_VAULT_A: 'hot' });
+        expect(v.get('TEST_VAULT_A')).toBe('hot');
+    });
+    it('patch with empty string removes key', () => {
+        const v = new NexusVault();
+        v.seedFromProcessEnv();
+        v.patch({ TEST_VAULT_B: '' });
+        expect(v.has('TEST_VAULT_B')).toBe(false);
+    });
+    it('replaceAll re-seeds from env then applies entries', () => {
+        const v = new NexusVault();
+        v.patch({ EPHEMERAL: 'gone' });
+        expect(v.get('EPHEMERAL')).toBe('gone');
+        v.replaceAll({ EPHEMERAL: '' });
+        expect(v.has('EPHEMERAL')).toBe(false);
+        expect(v.get('TEST_VAULT_A')).toBe('one');
+    });
+});
+//# sourceMappingURL=vault.test.js.map

package/dist/vault.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.test.js","sourceRoot":"","sources":["../src/vault.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAEhC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,CAAC,CAAC,kBAAkB,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,CAAC,CAAC,kBAAkB,EAAE,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@nexus_js/security",
+  "version": "0.7.4",
+  "description": "Nexus Hardened Core — Vault-lite (hot secrets) and Shield-lite (build manifest helpers)",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bierfor/nexus.git",
+    "directory": "packages/security"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}