@nodetool-ai/security 0.7.0-rc.23 → 0.8.1

package/README.md

@@ -0,0 +1,42 @@
+# @nodetool-ai/security
+
+Secret storage and encryption for [NodeTool](https://nodetool.ai) — master-key management and crypto helpers.
+
+This package owns encryption at rest for the NodeTool backend. It derives and stores a master key (OS keychain via keytar or environment variable) and encrypts and decrypts secrets, including Fernet-compatible payloads.
+
+## Install
+
+```bash
+npm install @nodetool-ai/security
+```
+
+## Exported symbols
+
+| Symbol | Kind | Description |
+| --- | --- | --- |
+| `generateMasterKey` | function | Generate a new random master key |
+| `deriveKey` | function | Derive an encryption key from a passphrase |
+| `encrypt` / `decrypt` | function | Encrypt and decrypt payloads with the master key |
+| `encryptFernet` / `decryptFernet` | function | Fernet-compatible encryption for cross-runtime secrets |
+| `isValidMasterKey` | function | Validate a master-key string |
+| `getMasterKey` / `initMasterKey` | function | Read or initialize the active master key |
+| `setMasterKey` / `setMasterKeyPersistent` / `deleteMasterKey` | function | Set (optionally persist to keychain) or delete the master key |
+| `clearMasterKeyCache` | function | Clear the in-memory key cache |
+| `isUsingEnvKey` | function | Report whether the env var supplies the key |
+| `setKeytarLoader` / `resetKeytarLoader` | function | Override the keytar loader (for tests) |
+| `KeychainAccessError` | class | Error thrown when the OS keychain is unreachable |
+
+## Usage
+
+```ts
+import { initMasterKey, encrypt, decrypt } from "@nodetool-ai/security";
+
+await initMasterKey();
+const sealed = encrypt("sk-secret-value");
+const plain = decrypt(sealed);
+```
+
+## Links
+
+- [NodeTool](https://nodetool.ai)
+- [GitHub](https://github.com/nodetool-ai/nodetool)

package/dist/.nodetool-build-stamp

@@ -0,0 +1 @@
+2026-09-28T09:19:03.160Z

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsBH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CAcR;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CA8BR;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CAiDR;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CA+CR;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAOT"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAInE;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CAeR;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CA+BR;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CAoDR;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CAiDR;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAOT"}

package/dist/crypto.js

@@ -9,6 +9,7 @@
  */
 import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv, createHmac, timingSafeEqual } from "node:crypto";
 import { createLogger } from "@nodetool-ai/config";
+// Stryker disable next-line StringLiteral: logger name is diagnostic, not behavior
 const log = createLogger("nodetool.security.crypto");
 // Fernet token version byte
 const FERNET_VERSION = 0x80;
@@ -35,6 +36,7 @@ export function generateMasterKey() {
  * @returns A 32-byte derived key as a Buffer.
  */
 export function deriveKey(masterKey, userId) {
+    // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
     const salt = Buffer.from(userId, "utf-8");
     return pbkdf2Sync(masterKey, salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha256");
 }
@@ -53,6 +55,7 @@ export function encrypt(masterKey, userId, plaintext) {
     const iv = randomBytes(IV_LENGTH);
     const cipher = createCipheriv("aes-256-gcm", key, iv);
     const encrypted = Buffer.concat([
+        // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
         cipher.update(plaintext, "utf-8"),
         cipher.final()
     ]);
@@ -89,6 +92,7 @@ export function decrypt(masterKey, userId, encryptedValue) {
         return decrypted.toString("utf-8");
     }
     catch (err) {
+        // Stryker disable next-line all: diagnostic log, not behavior
         log.debug("AES-GCM decryption failed (may fall back to Fernet)", {
             error: String(err)
         });
@@ -107,7 +111,9 @@ export function decrypt(masterKey, userId, encryptedValue) {
  */
 export function decryptFernet(masterKey, userId, encryptedValue) {
     // Python uses master_key.encode() — the UTF-8 bytes of the base64 string itself as PBKDF2 password
+    // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
     const masterKeyBytes = Buffer.from(masterKey, "utf-8");
+    // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
     const salt = Buffer.from(userId, "utf-8");
     const derived = pbkdf2Sync(masterKeyBytes, salt, PBKDF2_ITERATIONS, 32, "sha256");
     // Fernet splits the 32-byte derived key: first 16 = HMAC key, last 16 = AES-128 key
@@ -115,7 +121,9 @@ export function decryptFernet(masterKey, userId, encryptedValue) {
     const aesKey = derived.subarray(16, 32);
     // Decode Fernet token from base64url
     const b64token = encryptedValue.replace(/-/g, "+").replace(/_/g, "/");
-    const token = Buffer.from(b64token + "=".repeat((4 - (b64token.length % 4)) % 4), "base64");
+    const token = Buffer.from(
+    // Stryker disable next-line StringLiteral,ArithmeticOperator: re-padding is a no-op — Node's base64 decoder ignores +/- padding, so these mutants are equivalent
+    b64token + "=".repeat((4 - (b64token.length % 4)) % 4), "base64");
     // Token layout: version(1) + timestamp(8) + iv(16) + ciphertext(N) + hmac(32)
     if (token.length < 1 + 8 + 16 + 32) {
         throw new Error("Invalid Fernet token: too short");
@@ -151,7 +159,9 @@ export function decryptFernet(masterKey, userId, encryptedValue) {
  * @param plaintext - The plaintext to encrypt.
  */
 export function encryptFernet(masterKey, userId, plaintext) {
+    // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
     const masterKeyBytes = Buffer.from(masterKey, "utf-8");
+    // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
     const salt = Buffer.from(userId, "utf-8");
     const derived = pbkdf2Sync(masterKeyBytes, salt, PBKDF2_ITERATIONS, 32, "sha256");
     const hmacKey = derived.subarray(0, 16);
@@ -162,6 +172,7 @@ export function encryptFernet(masterKey, userId, plaintext) {
     const tsBuf = Buffer.alloc(8);
     tsBuf.writeBigUInt64BE(timestamp);
     // Pad plaintext to 16-byte boundary (PKCS7)
+    // Stryker disable next-line StringLiteral: encoding arg — Node decodes "" as utf-8, so this mutant is behaviorally equivalent
     const plaintextBuf = Buffer.from(plaintext, "utf-8");
     const padLen = 16 - (plaintextBuf.length % 16);
     const padded = Buffer.concat([plaintextBuf, Buffer.alloc(padLen, padLen)]);
@@ -178,12 +189,11 @@ export function encryptFernet(masterKey, userId, plaintext) {
     // HMAC-SHA256 over body
     const hmac = createHmac("sha256", hmacKey).update(body).digest();
     const token = Buffer.concat([body, hmac]);
-    // Encode as base64url (no padding)
-    return token
-        .toString("base64")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=/g, "");
+    // Encode as base64url *with* padding. Python's cryptography.Fernet decodes
+    // tokens with base64.urlsafe_b64decode, which rejects unpadded input
+    // ("Incorrect padding" -> InvalidToken), so the "=" padding must be kept for
+    // cross-runtime compatibility.
+    return token.toString("base64").replace(/\+/g, "-").replace(/\//g, "_");
 }
 /**
  * Check if a master key is valid by attempting to decrypt a test value.

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,WAAW,EACX,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,eAAe,EAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAErD,4BAA4B;AAC5B,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,uBAAuB;AAC9C,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,kBAAkB;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AAEvC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,uDAAuD;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAChC,SAAS,EACT,MAAM,CAAC,MAAM,GAAG,eAAe,CAChC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAC/D,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,mGAAmG;IACnG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CACxB,cAAc,EACd,IAAI,EACJ,iBAAiB,EACjB,EAAE,EACF,QAAQ,CACT,CAAC;IAEF,oFAAoF;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExC,qCAAqC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACtD,QAAQ,CACT,CAAC;IAEF,8EAA8E;IAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErC,qBAAqB;IACrB,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CACxB,cAAc,EACd,IAAI,EACJ,iBAAiB,EACjB,EAAE,EACF,QAAQ,CACT,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,sDAAsD;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAElC,4CAA4C;IAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE1E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7B,KAAK;QACL,EAAE;QACF,UAAU;KACX,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,mCAAmC;IACnC,OAAO,KAAK;SACT,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,kBAA0B,EAC1B,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,WAAW,EACX,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,eAAe,EAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,mFAAmF;AACnF,MAAM,GAAG,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAErD,4BAA4B;AAC5B,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,uBAAuB;AAC9C,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,kBAAkB;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AAEvC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc;IACzD,8HAA8H;IAC9H,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,8HAA8H;QAC9H,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,uDAAuD;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAChC,SAAS,EACT,MAAM,CAAC,MAAM,GAAG,eAAe,CAChC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8DAA8D;QAC9D,GAAG,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAC/D,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,mGAAmG;IACnG,8HAA8H;IAC9H,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,8HAA8H;IAC9H,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CACxB,cAAc,EACd,IAAI,EACJ,iBAAiB,EACjB,EAAE,EACF,QAAQ,CACT,CAAC;IAEF,oFAAoF;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExC,qCAAqC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI;IACvB,iKAAiK;IACjK,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACtD,QAAQ,CACT,CAAC;IAEF,8EAA8E;IAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErC,qBAAqB;IACrB,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,8HAA8H;IAC9H,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,8HAA8H;IAC9H,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CACxB,cAAc,EACd,IAAI,EACJ,iBAAiB,EACjB,EAAE,EACF,QAAQ,CACT,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,sDAAsD;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAElC,4CAA4C;IAC5C,8HAA8H;IAC9H,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE1E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7B,KAAK;QACL,EAAE;QACF,UAAU;KACX,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,qEAAqE;IACrE,6EAA6E;IAC7E,+BAA+B;IAC/B,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,kBAA0B,EAC1B,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,3 @@
 export { generateMasterKey, deriveKey, encrypt, decrypt, decryptFernet, encryptFernet, isValidMasterKey } from "./crypto.js";
-export { getMasterKey, initMasterKey, clearMasterKeyCache, setMasterKey, setMasterKeyPersistent, deleteMasterKey, isUsingEnvKey, isUsingAwsKey, setKeytarLoader, resetKeytarLoader, KeychainAccessError } from "./master-key.js";
-export { runStartupChecks, type StartupCheckResult } from "./startup-checks.js";
+export { getMasterKey, initMasterKey, clearMasterKeyCache, setMasterKey, setMasterKeyPersistent, deleteMasterKey, isUsingEnvKey, setKeytarLoader, resetKeytarLoader, KeychainAccessError } from "./master-key.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -1,4 +1,3 @@
 export { generateMasterKey, deriveKey, encrypt, decrypt, decryptFernet, encryptFernet, isValidMasterKey } from "./crypto.js";
-export { getMasterKey, initMasterKey, clearMasterKeyCache, setMasterKey, setMasterKeyPersistent, deleteMasterKey, isUsingEnvKey, isUsingAwsKey, setKeytarLoader, resetKeytarLoader, KeychainAccessError } from "./master-key.js";
-export { runStartupChecks } from "./startup-checks.js";
+export { getMasterKey, initMasterKey, clearMasterKeyCache, setMasterKey, setMasterKeyPersistent, deleteMasterKey, isUsingEnvKey, setKeytarLoader, resetKeytarLoader, KeychainAccessError } from "./master-key.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAA2B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC"}

package/dist/master-key.d.ts

@@ -1,15 +1,13 @@
 /**
- * Master key management with keychain and AWS Secrets Manager support.
+ * Master key management with keychain support.
  *
  * This module manages the master encryption key for secrets, storing it securely
- * in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
- * or AWS Secrets Manager.
+ * in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service).
  *
  * Key sources (in order of precedence):
  * 1. SECRETS_MASTER_KEY environment variable
- * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME env var set)
- * 3. System keychain via keytar
- * 4. Auto-generated key (persisted to keychain when available)
+ * 2. System keychain via keytar
+ * 3. Auto-generated key (persisted to keychain when available)
  *
  * NOTE on encryption compatibility: TS uses AES-256-GCM while Python uses Fernet.
  * Secrets encrypted in one runtime cannot be decrypted in the other.
@@ -41,27 +39,32 @@ export declare function resetKeytarLoader(): void;
  * Get the master encryption key (synchronous).
  *
  * Checks sources in order:
- * 1. Cached key (if previously retrieved, e.g. via initMasterKey)
- * 2. SECRETS_MASTER_KEY environment variable
- * 3. Auto-generates a new key (will not persist unless initMasterKey was called)
+ * 1. Cached key (set previously by initMasterKey, setMasterKey, or a prior
+ *    getMasterKey hit on SECRETS_MASTER_KEY).
+ * 2. SECRETS_MASTER_KEY environment variable.
  *
- * For full resolution including keychain and AWS, call initMasterKey() once at startup.
+ * Throws if neither is available. Callers MUST call {@link initMasterKey}
+ * once at process startup (which loads from keychain / env and
+ * persists a fresh key on first run) before the first sync access.
+ * Auto-generating an ephemeral key here would silently encrypt secrets
+ * with a value that disappears on exit — making them undecryptable on
+ * the next launch — so we surface the missing-init explicitly instead.
  *
  * @returns The master key as a base64-encoded string.
+ * @throws  If the key has not been initialized.
  */
 export declare function getMasterKey(): string;
 /**
  * Initialize the master key from all available sources (async).
  *
  * Should be called once at application startup to resolve the master key
- * from keychain or AWS Secrets Manager. After this call, getMasterKey()
- * will return the resolved key synchronously.
+ * from the keychain. After this call, getMasterKey() will return the
+ * resolved key synchronously.
  *
  * Resolution order:
  * 1. SECRETS_MASTER_KEY environment variable
- * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME is set)
- * 3. System keychain via keytar
- * 4. Auto-generate and persist to keychain
+ * 2. System keychain via keytar
+ * 3. Auto-generate and persist to keychain
  *
  * @returns The master key as a base64-encoded string.
  */
@@ -70,7 +73,7 @@ export declare function initMasterKey(): Promise<string>;
  * Clear the cached master key.
  *
  * Forces the next call to getMasterKey() or initMasterKey() to
- * re-read from environment, AWS, or keychain.
+ * re-read from environment or keychain.
  */
 export declare function clearMasterKeyCache(): void;
 /**
@@ -101,11 +104,5 @@ export declare function deleteMasterKey(): Promise<boolean>;
  * @returns True if SECRETS_MASTER_KEY environment variable is set.
  */
 export declare function isUsingEnvKey(): boolean;
-/**
- * Check if the master key should be sourced from AWS Secrets Manager.
- *
- * @returns True if AWS_SECRETS_MASTER_KEY_NAME environment variable is set.
- */
-export declare function isUsingAwsKey(): boolean;
 export {};
 //# sourceMappingURL=master-key.d.ts.map

package/dist/master-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"master-key.d.ts","sourceRoot":"","sources":["../src/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,uDAAuD;AACvD,UAAU,YAAY;IACpB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAkCD;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,YAAY,GAAG,IAAI,CAG9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAkBrC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAuDrD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAQxD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}
+{"version":3,"file":"master-key.d.ts","sourceRoot":"","sources":["../src/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,uDAAuD;AACvD,UAAU,YAAY;IACpB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAoCD;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,YAAY,GAAG,IAAI,CAG9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAmBrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAmBrD;AA0DD;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAQxD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}

package/dist/master-key.js

@@ -1,27 +1,27 @@
 /**
- * Master key management with keychain and AWS Secrets Manager support.
+ * Master key management with keychain support.
  *
  * This module manages the master encryption key for secrets, storing it securely
- * in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
- * or AWS Secrets Manager.
+ * in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service).
  *
  * Key sources (in order of precedence):
  * 1. SECRETS_MASTER_KEY environment variable
- * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME env var set)
- * 3. System keychain via keytar
- * 4. Auto-generated key (persisted to keychain when available)
+ * 2. System keychain via keytar
+ * 3. Auto-generated key (persisted to keychain when available)
  *
  * NOTE on encryption compatibility: TS uses AES-256-GCM while Python uses Fernet.
  * Secrets encrypted in one runtime cannot be decrypted in the other.
  * New secrets must be created via the appropriate runtime's endpoints.
  */
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { generateMasterKey } from "./crypto.js";
 import { createLogger } from "@nodetool-ai/config";
+// Stryker disable next-line StringLiteral: logger name is diagnostic, not behavior
 const log = createLogger("nodetool.security.master-key");
 const KEYRING_SERVICE = "nodetool";
 const KEYRING_ACCOUNT = "secrets_master_key";
 let cachedMasterKey = null;
+/** In-flight resolution promise, used to de-duplicate concurrent first-run inits. */
+let initInFlight = null;
 /**
  * Thrown when the system keychain cannot be accessed. Callers can detect this
  * specifically (vs other startup failures) to decide whether re-prompting the
@@ -39,6 +39,7 @@ function keychainAccessError(message) {
 /** Lazy-load keytar. Keychain failures are fatal: no generated fallback key. */
 let _keytarResolved = null;
 async function loadKeytar() {
+    // Stryker disable next-line ConditionalExpression,BlockStatement: cache fast-path — re-importing yields the same module, so this mutant is behaviorally equivalent
     if (_keytarResolved) {
         return _keytarResolved;
     }
@@ -49,10 +50,11 @@ async function loadKeytar() {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        // Stryker disable all: diagnostic log, not behavior
         log.error("keytar native module failed to load. For headless deployments " +
             "(Docker, CI, Linux servers without libsecret) set the SECRETS_MASTER_KEY " +
-            "environment variable to a base64-encoded 32-byte key, or set " +
-            "AWS_SECRETS_MASTER_KEY_NAME to source the key from AWS Secrets Manager.", { error: message });
+            "environment variable to a base64-encoded 32-byte key.", { error: message });
+        // Stryker restore all
         throw keychainAccessError(`Unable to load system keychain backend: ${message}`);
     }
 }
@@ -72,104 +74,97 @@ export function resetKeytarLoader() {
     _keytar = null;
     _keytarResolved = null;
 }
-/**
- * Retrieve master key from AWS Secrets Manager.
- *
- * Only attempted if AWS_SECRETS_MASTER_KEY_NAME environment variable is set.
- */
-async function getFromAwsSecrets(secretName) {
-    try {
-        const region = process.env["AWS_REGION"] ?? "us-east-1";
-        const client = new SecretsManagerClient({ region });
-        const response = await client.send(new GetSecretValueCommand({ SecretId: secretName }));
-        if (response.SecretString) {
-            return response.SecretString;
-        }
-        if (response.SecretBinary) {
-            return Buffer.from(response.SecretBinary).toString("utf-8");
-        }
-        return null;
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        log.warn("Master key source failed, trying next", {
-            source: "aws",
-            error: message
-        });
-        return null;
-    }
-}
 /**
  * Get the master encryption key (synchronous).
  *
  * Checks sources in order:
- * 1. Cached key (if previously retrieved, e.g. via initMasterKey)
- * 2. SECRETS_MASTER_KEY environment variable
- * 3. Auto-generates a new key (will not persist unless initMasterKey was called)
+ * 1. Cached key (set previously by initMasterKey, setMasterKey, or a prior
+ *    getMasterKey hit on SECRETS_MASTER_KEY).
+ * 2. SECRETS_MASTER_KEY environment variable.
  *
- * For full resolution including keychain and AWS, call initMasterKey() once at startup.
+ * Throws if neither is available. Callers MUST call {@link initMasterKey}
+ * once at process startup (which loads from keychain / env and
+ * persists a fresh key on first run) before the first sync access.
+ * Auto-generating an ephemeral key here would silently encrypt secrets
+ * with a value that disappears on exit — making them undecryptable on
+ * the next launch — so we surface the missing-init explicitly instead.
  *
  * @returns The master key as a base64-encoded string.
+ * @throws  If the key has not been initialized.
  */
 export function getMasterKey() {
     if (cachedMasterKey !== null) {
         return cachedMasterKey;
     }
-    // 1. Check environment variable
     const envKey = process.env["SECRETS_MASTER_KEY"];
     if (envKey) {
+        // Stryker disable next-line all: diagnostic log, not behavior
         log.debug("Master key source", { source: "env" });
         cachedMasterKey = envKey;
         return envKey;
     }
-    // 2. Auto-generate (not persisted without initMasterKey)
-    log.debug("Master key source", { source: "generated" });
-    const newKey = generateMasterKey();
-    cachedMasterKey = newKey;
-    return newKey;
+    throw new Error("Master key is not initialized. Call `initMasterKey()` once at startup " +
+        "(loads from system keychain / SECRETS_MASTER_KEY) " +
+        "before any synchronous secret access. Auto-generating a key here would " +
+        "silently encrypt secrets with a value that disappears on process exit.");
 }
 /**
  * Initialize the master key from all available sources (async).
  *
  * Should be called once at application startup to resolve the master key
- * from keychain or AWS Secrets Manager. After this call, getMasterKey()
- * will return the resolved key synchronously.
+ * from the keychain. After this call, getMasterKey() will return the
+ * resolved key synchronously.
  *
  * Resolution order:
  * 1. SECRETS_MASTER_KEY environment variable
- * 2. AWS Secrets Manager (if AWS_SECRETS_MASTER_KEY_NAME is set)
- * 3. System keychain via keytar
- * 4. Auto-generate and persist to keychain
+ * 2. System keychain via keytar
+ * 3. Auto-generate and persist to keychain
  *
  * @returns The master key as a base64-encoded string.
  */
 export async function initMasterKey() {
-    // Return cached key if available
     if (cachedMasterKey !== null) {
         return cachedMasterKey;
     }
+    // Single-flight: concurrent first-run callers share one resolution. Without
+    // this, each would independently generate a *different* key and race to
+    // persist it, leaving the cache and keychain inconsistent and orphaning any
+    // secrets encrypted under the losing key.
+    if (initInFlight !== null) {
+        return initInFlight;
+    }
+    initInFlight = resolveMasterKey();
+    try {
+        return await initInFlight;
+    }
+    finally {
+        initInFlight = null;
+    }
+}
+/** Resolve the master key from all sources. See {@link initMasterKey}. */
+async function resolveMasterKey() {
     // 1. Check environment variable
     const envKey = process.env["SECRETS_MASTER_KEY"];
     if (envKey) {
+        // Stryker disable next-line all: diagnostic log, not behavior
         log.debug("Master key source", { source: "env" });
         cachedMasterKey = envKey;
         return envKey;
     }
-    // 2. Check AWS Secrets Manager if configured
-    const awsSecretName = process.env["AWS_SECRETS_MASTER_KEY_NAME"];
-    if (awsSecretName) {
-        const awsKey = await getFromAwsSecrets(awsSecretName);
-        if (awsKey) {
-            log.debug("Master key source", { source: "aws" });
-            cachedMasterKey = awsKey;
-            return awsKey;
-        }
+    // AWS Secrets Manager support was removed. Fail fast instead of silently
+    // ignoring the variable: falling through to a generated key would orphan
+    // every secret encrypted under the AWS-sourced key.
+    if (process.env["AWS_SECRETS_MASTER_KEY_NAME"]) {
+        throw new Error("AWS_SECRETS_MASTER_KEY_NAME is set, but AWS Secrets Manager support " +
+            "has been removed. Set SECRETS_MASTER_KEY to the key value that was " +
+            "stored in AWS Secrets Manager, then unset AWS_SECRETS_MASTER_KEY_NAME.");
     }
-    // 3. Try system keychain via keytar
-    const keytar = _keytar ?? await loadKeytar();
+    // 2. Try system keychain via keytar
+    const keytar = _keytar ?? (await loadKeytar());
     try {
         const storedKey = await keytar.getPassword(KEYRING_SERVICE, KEYRING_ACCOUNT);
         if (storedKey) {
+            // Stryker disable next-line all: diagnostic log, not behavior
             log.debug("Master key source", { source: "keychain" });
             cachedMasterKey = storedKey;
             return storedKey;
@@ -179,12 +174,13 @@ export async function initMasterKey() {
         const message = err instanceof Error ? err.message : String(err);
         throw keychainAccessError(`Unable to read master key from system keychain: ${message}`);
     }
-    // 4. Auto-generate and persist to keychain. Persisting is mandatory; using
+    // 3. Auto-generate and persist to keychain. Persisting is mandatory; using
     // an unpersisted generated key would make encrypted secrets unrecoverable on
     // the next launch.
     const newKey = generateMasterKey();
     try {
         await keytar.setPassword(KEYRING_SERVICE, KEYRING_ACCOUNT, newKey);
+        // Stryker disable next-line all: diagnostic log, not behavior
         log.info("Master key generated and stored");
     }
     catch (err) {
@@ -198,7 +194,7 @@ export async function initMasterKey() {
  * Clear the cached master key.
  *
  * Forces the next call to getMasterKey() or initMasterKey() to
- * re-read from environment, AWS, or keychain.
+ * re-read from environment or keychain.
  */
 export function clearMasterKeyCache() {
     cachedMasterKey = null;
@@ -244,12 +240,4 @@ export async function deleteMasterKey() {
 export function isUsingEnvKey() {
     return process.env["SECRETS_MASTER_KEY"] !== undefined;
 }
-/**
- * Check if the master key should be sourced from AWS Secrets Manager.
- *
- * @returns True if AWS_SECRETS_MASTER_KEY_NAME environment variable is set.
- */
-export function isUsingAwsKey() {
-    return process.env["AWS_SECRETS_MASTER_KEY_NAME"] !== undefined;
-}
 //# sourceMappingURL=master-key.js.map

package/dist/master-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"master-key.js","sourceRoot":"","sources":["../src/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,IAAI,eAAe,GAAkB,IAAI,CAAC;AAa1C;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,IAAI,mBAAmB,CAC5B,GAAG,OAAO,+DAA+D,CAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,IAAI,eAAe,GAAwB,IAAI,CAAC;AAChD,KAAK,UAAU,UAAU;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,eAAe,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACrC,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,KAAK,CACP,gEAAgE;YAC9D,2EAA2E;YAC3E,+DAA+D;YAC/D,yEAAyE,EAC3E,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACF,MAAM,mBAAmB,CAAC,2CAA2C,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAwB;IACtD,OAAO,GAAG,UAAU,CAAC;IACrB,eAAe,GAAG,UAAU,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,IAAI,CAAC;IACf,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CACpD,CAAC;QAEF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,YAAY,CAAC;QAC/B,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE;YAChD,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yDAAyD;IACzD,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,eAAe,GAAG,MAAM,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,iCAAiC;IACjC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACjE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,eAAe,GAAG,MAAM,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CACxC,eAAe,EACf,eAAe,CAChB,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACvD,eAAe,GAAG,SAAS,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,kDAAkD,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,eAAe,GAAG,MAAM,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IACtE,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,eAAe,EACf,eAAe,CAChB,CAAC;IACF,eAAe,GAAG,IAAI,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC"}
+{"version":3,"file":"master-key.js","sourceRoot":"","sources":["../src/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,mFAAmF;AACnF,MAAM,GAAG,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,IAAI,eAAe,GAAkB,IAAI,CAAC;AAE1C,qFAAqF;AACrF,IAAI,YAAY,GAA2B,IAAI,CAAC;AAahD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,IAAI,mBAAmB,CAC5B,GAAG,OAAO,+DAA+D,CAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,IAAI,eAAe,GAAwB,IAAI,CAAC;AAChD,KAAK,UAAU,UAAU;IACvB,mKAAmK;IACnK,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,eAAe,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACrC,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,oDAAoD;QACpD,GAAG,CAAC,KAAK,CACP,gEAAgE;YAC9D,2EAA2E;YAC3E,uDAAuD,EACzD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACF,sBAAsB;QACtB,MAAM,mBAAmB,CAAC,2CAA2C,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAwB;IACtD,OAAO,GAAG,UAAU,CAAC;IACrB,eAAe,GAAG,UAAU,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,IAAI,CAAC;IACf,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,8DAA8D;QAC9D,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,wEAAwE;QACtE,oDAAoD;QACpD,yEAAyE;QACzE,wEAAwE,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,gBAAgB;IAC7B,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,8DAA8D;QAC9D,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,oDAAoD;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,qEAAqE;YACrE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CACxC,eAAe,EACf,eAAe,CAChB,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,8DAA8D;YAChE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrD,eAAe,GAAG,SAAS,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QACnE,8DAA8D;QAC9D,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,mBAAmB,CAAC,kDAAkD,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,eAAe,GAAG,MAAM,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IACtE,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,UAAU,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,eAAe,EACf,eAAe,CAChB,CAAC;IACF,eAAe,GAAG,IAAI,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,22 +1,27 @@
 {
   "name": "@nodetool-ai/security",
-  "version": "0.7.0-rc.23",
+  "version": "0.8.1",
   "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "node ../../scripts/build-typescript-workspace.mjs",
-    "test": "vitest run",
-    "lint": "tsc --noEmit"
+    "test": "node ../../scripts/run-vitest.mjs run",
+    "test:mutation": "stryker run",
+    "lint": "node ../../scripts/run-tsc.mjs --noEmit"
   },
   "dependencies": {
-    "@nodetool-ai/config": "^0.7.0-rc.23",
-    "@aws-sdk/client-secrets-manager": "^3.1029.0",
+    "@nodetool-ai/config": "^0.8.1",
     "keytar": "^7.9.0"
   },
   "devDependencies": {
-    "vitest": "^4.1.2",
-    "typescript": "^5.7.2"
+    "@stryker-mutator/core": "^9.6.1",
+    "@stryker-mutator/vitest-runner": "^9.6.1",
+    "typescript": "npm:@typescript/typescript6@6.0.2",
+    "vitest": "^5.0.1"
   },
   "exports": {
     ".": {
@@ -42,5 +47,18 @@
   "files": [
     "dist",
     "README.md"
+  ],
+  "description": "Secret storage and encryption for NodeTool — master-key management, crypto helpers, and startup security checks",
+  "keywords": [
+    "nodetool",
+    "ai",
+    "workflow",
+    "workflow-automation",
+    "typescript",
+    "encryption",
+    "secrets",
+    "secret-storage",
+    "crypto",
+    "security"
   ]
 }

package/dist/startup-checks.d.ts

@@ -1,12 +0,0 @@
-export interface StartupCheckResult {
-    errors: string[];
-    warnings: string[];
-}
-/**
- * Run startup health checks.
- *
- * - Checks that the master encryption key is loadable.
- * - Warns about missing optional API keys.
- */
-export declare function runStartupChecks(): Promise<StartupCheckResult>;
-//# sourceMappingURL=startup-checks.d.ts.map

package/dist/startup-checks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-checks.d.ts","sourceRoot":"","sources":["../src/startup-checks.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAaD;;;;;GAKG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAyBpE"}

package/dist/startup-checks.js

@@ -1,45 +0,0 @@
-/**
- * Startup checks — T-SEC-8.
- *
- * Validates that the system is properly configured before accepting requests.
- */
-import { getMasterKey } from "./master-key.js";
-/** Well-known optional API keys that should be configured for full functionality. */
-const OPTIONAL_API_KEYS = [
-    "OPENAI_API_KEY",
-    "ANTHROPIC_API_KEY",
-    "GEMINI_API_KEY",
-    "REPLICATE_API_TOKEN",
-    "HF_TOKEN",
-    "ELEVENLABS_API_KEY",
-    "FAL_API_KEY"
-];
-/**
- * Run startup health checks.
- *
- * - Checks that the master encryption key is loadable.
- * - Warns about missing optional API keys.
- */
-export async function runStartupChecks() {
-    const errors = [];
-    const warnings = [];
-    // Check master key
-    try {
-        const key = getMasterKey();
-        if (!key) {
-            errors.push("Master encryption key could not be loaded");
-        }
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        errors.push(`Master key initialization failed: ${msg}`);
-    }
-    // Check optional API keys
-    for (const envVar of OPTIONAL_API_KEYS) {
-        if (!process.env[envVar]) {
-            warnings.push(`${envVar} is not set — related features will be unavailable`);
-        }
-    }
-    return { errors, warnings };
-}
-//# sourceMappingURL=startup-checks.js.map

package/dist/startup-checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-checks.js","sourceRoot":"","sources":["../src/startup-checks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C,qFAAqF;AACrF,MAAM,iBAAiB,GAAG;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,oDAAoD,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}