@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/secrets/session-store.d.ts

@@ -1,107 +0,0 @@
-/**
- * Durable "unlocked session" store (macOS).
- *
- * The secrets broker (agent.ts) holds unlocked bundles only in RAM, so an
- * `agents secrets unlock` grant is lost whenever that process dies: on an
- * agents-cli upgrade (the postinstall bounces the daemon) and on system SLEEP.
- * This module persists the resolved bundle+env of an unlocked bundle as a
- * NO-ACL keychain item — the `set-no-acl` write path, `kSecAttrAccessibleAfter-
- * FirstUnlockThisDeviceOnly`, whose reads never pop Touch ID — so the broker can
- * REHYDRATE it on start and reads can FALL BACK to it when the broker RAM misses.
- *
- * Split-default posture: `sleepPersist` is false by default — the item is deleted
- * on SLEEP so the bundle re-locks on sleep but survives restart/upgrade; the
- * `--durable` flag sets it true so it survives sleep too. Both expire at the TTL.
- *
- * Cross-platform: a NO-OP off macOS. Linux (secret-service) and Windows
- * (Credential Manager) have no broker and resolve secrets durably from the OS
- * store on every read with no prompt (see agent.ts:onDarwin gates) — there is no
- * ephemeral unlock to persist.
- *
- * NEVER enumerate session items: once keychain-name hashing (#316) is active a
- * `list('agents-cli.session.')` matches nothing. All I/O is by KNOWN name — one
- * fixed-name index item lists the held bundles + their metadata, and one blob per
- * bundle holds the env. Every adapter call is best-effort and never throws;
- * persistence is an optimization, not a correctness dependency.
- */
-import type { SecretsBundle } from './bundles.js';
-import type { SecretLease } from './lease.js';
-/** Prefix for all durable session items (device-local, no-ACL). */
-export declare const SESSION_ITEM_PREFIX = "agents-cli.session.";
-/** Fixed-name index item — the ONLY thing we ever need to find without a known
- * bundle name, so it is read/written by this exact name (never enumerated). */
-export declare const SESSION_INDEX_ITEM = "agents-cli.session.index";
-/** One persisted unlocked bundle (mirrors the broker's StoredBundle + posture). */
-export interface SessionEntry {
-    bundle: SecretsBundle;
-    env: Record<string, string>;
-    /** epoch ms; the entry is dead once Date.now() passes this. */
-    expiresAt: number;
-    /** true only for `--durable` unlocks — survives SLEEP. */
-    sleepPersist: boolean;
-    harness?: string;
-    lease?: SecretLease;
-}
-/** Metadata for one held bundle, kept in the index so we can rehydrate / prune
- * without reading every blob. */
-export interface SessionIndexMeta {
-    expiresAt: number;
-    sleepPersist: boolean;
-    harness?: string;
-}
-export interface SessionIndex {
-    bundles: Record<string, SessionIndexMeta>;
-}
-/** The bundle names in the index that are still within their TTL at `now`. */
-export declare function selectRehydratable(index: SessionIndex, now: number): string[];
-/** Split an index on a SLEEP event: keep `sleepPersist` entries, report the rest
- * (which the caller deletes from the keychain). Default entries re-lock on sleep. */
-export declare function pruneOnSleep(index: SessionIndex): {
-    survivors: SessionIndex;
-    deletedNames: string[];
-};
-/** Drop entries past their TTL; report which were dropped so the caller can
- * delete their blobs. */
-export declare function pruneExpired(index: SessionIndex, now: number): {
-    survivors: SessionIndex;
-    expiredNames: string[];
-};
-/** Insert/replace one bundle in the index (pure). */
-export declare function upsertEntry(index: SessionIndex, name: string, meta: SessionIndexMeta): SessionIndex;
-/** Remove one bundle from the index (pure). */
-export declare function removeEntry(index: SessionIndex, name: string): SessionIndex;
-/** Read the session index by its fixed name. `{bundles:{}}` when absent/unreadable. */
-export declare function readIndex(): SessionIndex;
-/** Persist the index as a no-ACL item. Deletes the item when empty (tidy). */
-export declare function writeIndex(index: SessionIndex): void;
-/** Persist one unlocked bundle: write its blob no-ACL and record it in the index. */
-export declare function saveSession(name: string, entry: SessionEntry): void;
-/**
- * Read a session honoring the scope chain: the caller's own harness first, then
- * the global grant (see bundleScopeChain in scope.ts). This is the durable-store
- * twin of the broker's `get` — both must resolve identically, or a bundle would
- * be readable from RAM but not after a restart.
- */
-export declare function resolveSession(name: string, now?: number, harness?: string): {
-    entry: SessionEntry;
-    harness: string;
-} | null;
-/** Read one session blob by known name. Null when absent/expired/malformed. */
-export declare function loadSession(name: string, now?: number, harness?: string): SessionEntry | null;
-/** Remove every persisted harness grant for one bundle. */
-export declare function deleteBundleSessions(name: string): void;
-/** Delete one bundle's session blob and prune it from the index. */
-export declare function deleteSession(name: string, harness?: string): void;
-export declare function deleteLeaseSession(leaseId: string): number;
-/** Delete every session blob + the index (for `secrets lock --all`). */
-export declare function deleteAllSessions(): void;
-/** Rehydrate every unexpired session into `[name, entry]` pairs for the broker to
- * load on start; prunes expired index entries + blobs as a side effect. Survives
- * upgrade/restart. Empty off darwin or when nothing is held. */
-export declare function rehydrateSessions(now?: number): Array<{
-    name: string;
-    entry: SessionEntry;
-}>;
-/** On a SLEEP event: delete every non-`--durable` session (blob + index entry),
- * keep the durable ones. Default bundles thus re-lock on sleep. */
-export declare function pruneSessionsOnSleep(): void;

package/dist/lib/secrets/session-store.js

@@ -1,342 +0,0 @@
-/**
- * Durable "unlocked session" store (macOS).
- *
- * The secrets broker (agent.ts) holds unlocked bundles only in RAM, so an
- * `agents secrets unlock` grant is lost whenever that process dies: on an
- * agents-cli upgrade (the postinstall bounces the daemon) and on system SLEEP.
- * This module persists the resolved bundle+env of an unlocked bundle as a
- * NO-ACL keychain item — the `set-no-acl` write path, `kSecAttrAccessibleAfter-
- * FirstUnlockThisDeviceOnly`, whose reads never pop Touch ID — so the broker can
- * REHYDRATE it on start and reads can FALL BACK to it when the broker RAM misses.
- *
- * Split-default posture: `sleepPersist` is false by default — the item is deleted
- * on SLEEP so the bundle re-locks on sleep but survives restart/upgrade; the
- * `--durable` flag sets it true so it survives sleep too. Both expire at the TTL.
- *
- * Cross-platform: a NO-OP off macOS. Linux (secret-service) and Windows
- * (Credential Manager) have no broker and resolve secrets durably from the OS
- * store on every read with no prompt (see agent.ts:onDarwin gates) — there is no
- * ephemeral unlock to persist.
- *
- * NEVER enumerate session items: once keychain-name hashing (#316) is active a
- * `list('agents-cli.session.')` matches nothing. All I/O is by KNOWN name — one
- * fixed-name index item lists the held bundles + their metadata, and one blob per
- * bundle holds the env. Every adapter call is best-effort and never throws;
- * persistence is an optimization, not a correctness dependency.
- */
-import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden } from './index.js';
-import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
-/** Prefix for all durable session items (device-local, no-ACL). */
-export const SESSION_ITEM_PREFIX = 'agents-cli.session.';
-/** Fixed-name index item — the ONLY thing we ever need to find without a known
- * bundle name, so it is read/written by this exact name (never enumerated). */
-export const SESSION_INDEX_ITEM = 'agents-cli.session.index';
-// ─── Pure core (no I/O — unit-testable on any platform) ─────────────────────
-/** The bundle names in the index that are still within their TTL at `now`. */
-export function selectRehydratable(index, now) {
-    return Object.entries(index.bundles)
-        .filter(([, m]) => now < m.expiresAt)
-        .map(([name]) => name);
-}
-/** Split an index on a SLEEP event: keep `sleepPersist` entries, report the rest
- * (which the caller deletes from the keychain). Default entries re-lock on sleep. */
-export function pruneOnSleep(index) {
-    const survivors = { bundles: {} };
-    const deletedNames = [];
-    for (const [name, m] of Object.entries(index.bundles)) {
-        if (m.sleepPersist)
-            survivors.bundles[name] = m;
-        else
-            deletedNames.push(name);
-    }
-    return { survivors, deletedNames };
-}
-/** Drop entries past their TTL; report which were dropped so the caller can
- * delete their blobs. */
-export function pruneExpired(index, now) {
-    const survivors = { bundles: {} };
-    const expiredNames = [];
-    for (const [name, m] of Object.entries(index.bundles)) {
-        if (now < m.expiresAt)
-            survivors.bundles[name] = m;
-        else
-            expiredNames.push(name);
-    }
-    return { survivors, expiredNames };
-}
-/** Insert/replace one bundle in the index (pure). */
-export function upsertEntry(index, name, meta) {
-    return { bundles: { ...index.bundles, [name]: meta } };
-}
-/** Remove one bundle from the index (pure). */
-export function removeEntry(index, name) {
-    const { [name]: _drop, ...rest } = index.bundles;
-    void _drop;
-    return { bundles: rest };
-}
-// ─── Keychain adapter (macOS only; best-effort, never throws) ────────────────
-/** Whether to actually persist. macOS in production; also whenever a test
- * keychain backend is installed, so the adapter is exercisable on Linux CI
- * against an in-memory store (mirrors the broker's hermetic-test gating). In real
- * Linux/Windows production this is false — secrets already persist in the OS store
- * with no broker, so there is nothing to mirror. */
-function shouldPersist() {
-    return process.platform === 'darwin' || isKeychainBackendOverridden();
-}
-function sessionBlobItem(name, harness) {
-    return `${SESSION_ITEM_PREFIX}${harness}.${name}`;
-}
-/** Read the session index by its fixed name. `{bundles:{}}` when absent/unreadable. */
-export function readIndex() {
-    try {
-        // Written no-ACL (writeIndex below) — attest so a headless resolve stays silent.
-        const raw = getKeychainToken(SESSION_INDEX_ITEM, { silentNoAcl: true });
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object' && parsed.bundles)
-            return parsed;
-    }
-    catch {
-        /* absent or malformed → empty */
-    }
-    return { bundles: {} };
-}
-/** Persist the index as a no-ACL item. Deletes the item when empty (tidy). */
-export function writeIndex(index) {
-    try {
-        if (Object.keys(index.bundles).length === 0) {
-            deleteKeychainToken(SESSION_INDEX_ITEM);
-            return;
-        }
-        setKeychainToken(SESSION_INDEX_ITEM, JSON.stringify(index), { noAcl: true });
-    }
-    catch {
-        /* best-effort */
-    }
-}
-/** Persist one unlocked bundle: write its blob no-ACL and record it in the index. */
-export function saveSession(name, entry) {
-    if (!shouldPersist())
-        return;
-    try {
-        const harness = entry.harness || GLOBAL_HARNESS;
-        const key = `${harness}:${name}`;
-        setKeychainToken(sessionBlobItem(name, harness), JSON.stringify({ ...entry, harness }), { noAcl: true });
-        writeIndex(upsertEntry(readIndex(), key, { expiresAt: entry.expiresAt, sleepPersist: entry.sleepPersist, harness }));
-    }
-    catch {
-        /* best-effort — persistence is an optimization */
-    }
-}
-/**
- * Read a session honoring the scope chain: the caller's own harness first, then
- * the global grant (see bundleScopeChain in scope.ts). This is the durable-store
- * twin of the broker's `get` — both must resolve identically, or a bundle would
- * be readable from RAM but not after a restart.
- */
-export function resolveSession(name, now = Date.now(), harness = GLOBAL_HARNESS) {
-    for (const scope of bundleScopeChain(harness)) {
-        const entry = loadSession(name, now, scope);
-        if (entry)
-            return { entry, harness: scope };
-    }
-    return null;
-}
-/** Read one session blob by known name. Null when absent/expired/malformed. */
-export function loadSession(name, now = Date.now(), harness = GLOBAL_HARNESS) {
-    if (!shouldPersist())
-        return null;
-    try {
-        // Written no-ACL (saveSession) — attest so a headless resolve stays silent.
-        const raw = getKeychainToken(sessionBlobItem(name, harness), { silentNoAcl: true });
-        const entry = JSON.parse(raw);
-        if (!entry || typeof entry !== 'object' || !entry.bundle || !entry.env)
-            return null;
-        if (now >= entry.expiresAt) {
-            deleteSession(name, harness); // drop expired on read
-            return null;
-        }
-        return entry;
-    }
-    catch {
-        return null;
-    }
-}
-/** Remove every persisted harness grant for one bundle. */
-export function deleteBundleSessions(name) {
-    if (!shouldPersist())
-        return;
-    const index = readIndex();
-    let next = index;
-    for (const [key, meta] of Object.entries(index.bundles)) {
-        const scopedName = key.includes(':') ? key.split(':').slice(1).join(':') : key;
-        if (scopedName !== name)
-            continue;
-        const harness = meta.harness || GLOBAL_HARNESS;
-        try {
-            deleteKeychainToken(key.includes(':') ? sessionBlobItem(name, harness) : `${SESSION_ITEM_PREFIX}${name}`);
-        }
-        catch { /* keep going */ }
-        next = removeEntry(next, key);
-    }
-    writeIndex(next);
-}
-/** Delete one bundle's session blob and prune it from the index. */
-export function deleteSession(name, harness = GLOBAL_HARNESS) {
-    if (!shouldPersist())
-        return;
-    try {
-        deleteKeychainToken(sessionBlobItem(name, harness));
-        writeIndex(removeEntry(readIndex(), `${harness}:${name}`));
-    }
-    catch {
-        /* best-effort */
-    }
-}
-export function deleteLeaseSession(leaseId) {
-    if (!shouldPersist())
-        return 0;
-    const index = readIndex();
-    let deleted = 0;
-    for (const [key, meta] of Object.entries(index.bundles)) {
-        const bundleName = key.split(':').slice(1).join(':');
-        const harness = meta.harness || GLOBAL_HARNESS;
-        const entry = loadSession(bundleName, Date.now(), harness);
-        if (entry?.lease?.id !== leaseId)
-            continue;
-        deleteSession(bundleName, harness);
-        deleted++;
-    }
-    return deleted;
-}
-/** Delete every session blob + the index (for `secrets lock --all`). */
-export function deleteAllSessions() {
-    if (!shouldPersist())
-        return;
-    try {
-        for (const name of Object.keys(readIndex().bundles)) {
-            const meta = readIndex().bundles[name];
-            const bundleName = name.includes(':') ? name.split(':').slice(1).join(':') : name;
-            try {
-                deleteKeychainToken(name.includes(':')
-                    ? sessionBlobItem(bundleName, meta.harness || GLOBAL_HARNESS)
-                    : `${SESSION_ITEM_PREFIX}${bundleName}`);
-            }
-            catch { /* keep going */ }
-        }
-        deleteKeychainToken(SESSION_INDEX_ITEM);
-    }
-    catch {
-        /* best-effort */
-    }
-}
-/** Rehydrate every unexpired session into `[name, entry]` pairs for the broker to
- * load on start; prunes expired index entries + blobs as a side effect. Survives
- * upgrade/restart. Empty off darwin or when nothing is held. */
-export function rehydrateSessions(now = Date.now()) {
-    if (!shouldPersist())
-        return [];
-    const out = [];
-    try {
-        const index = readIndex();
-        // One-time source migration from the pre-harness layout. Move each legacy
-        // bundle-name index/blob to the explicit cli scope, then delete the old blob.
-        let migratedIndex = index;
-        for (const [key, meta] of Object.entries(index.bundles)) {
-            if (key.includes(':'))
-                continue;
-            try {
-                const raw = getKeychainToken(`${SESSION_ITEM_PREFIX}${key}`, { silentNoAcl: true });
-                const legacy = JSON.parse(raw);
-                setKeychainToken(sessionBlobItem(key, GLOBAL_HARNESS), JSON.stringify({ ...legacy, harness: GLOBAL_HARNESS }), { noAcl: true });
-                deleteKeychainToken(`${SESSION_ITEM_PREFIX}${key}`);
-                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), `${GLOBAL_HARNESS}:${key}`, {
-                    expiresAt: meta.expiresAt,
-                    sleepPersist: meta.sleepPersist,
-                    harness: GLOBAL_HARNESS,
-                });
-            }
-            catch { /* malformed/absent legacy entry is pruned below */ }
-        }
-        // Second source migration: `cli`-scoped grants predate the global scope. `cli`
-        // was never a harness — it was the default when no AGENTS_AGENT_NAME was set,
-        // i.e. "unlocked from a terminal for general use", which is exactly the global
-        // grant. Rewriting them means an unlock a user already paid Touch ID for keeps
-        // working after upgrade instead of silently becoming unreadable to every agent.
-        for (const [key, meta] of Object.entries(migratedIndex.bundles)) {
-            if (!key.startsWith('cli:'))
-                continue;
-            const bundleName = key.slice('cli:'.length);
-            const globalKey = `${GLOBAL_HARNESS}:${bundleName}`;
-            // A global grant for this bundle can already exist: the user re-runs
-            // `unlock` on the new code (which writes the global scope) before the
-            // broker restarts to run this migration. The existing global grant is the
-            // NEWER one, so the stale `cli` entry is discarded, never merged over it —
-            // overwriting would restore a superseded token and, if the stale entry had
-            // expired, hand its expiry to the fresh grant so the prune below deletes a
-            // valid unlock outright.
-            if (migratedIndex.bundles[globalKey]) {
-                try {
-                    deleteKeychainToken(sessionBlobItem(bundleName, 'cli'));
-                }
-                catch { /* already gone */ }
-                migratedIndex = removeEntry(migratedIndex, key);
-                continue;
-            }
-            try {
-                const raw = getKeychainToken(sessionBlobItem(bundleName, 'cli'), { silentNoAcl: true });
-                const legacy = JSON.parse(raw);
-                setKeychainToken(sessionBlobItem(bundleName, GLOBAL_HARNESS), JSON.stringify({ ...legacy, harness: GLOBAL_HARNESS }), { noAcl: true });
-                deleteKeychainToken(sessionBlobItem(bundleName, 'cli'));
-                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), globalKey, {
-                    expiresAt: meta.expiresAt,
-                    sleepPersist: meta.sleepPersist,
-                    harness: GLOBAL_HARNESS,
-                });
-            }
-            catch { /* malformed/absent entry is pruned below */ }
-        }
-        writeIndex(migratedIndex);
-        index.bundles = migratedIndex.bundles;
-        const { survivors, expiredNames } = pruneExpired(index, now);
-        for (const name of expiredNames) {
-            const meta = index.bundles[name];
-            try {
-                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || GLOBAL_HARNESS));
-            }
-            catch { /* keep going */ }
-        }
-        if (expiredNames.length)
-            writeIndex(survivors);
-        for (const name of selectRehydratable(survivors, now)) {
-            const meta = survivors.bundles[name];
-            const bundleName = name.split(':').slice(1).join(':');
-            const entry = loadSession(bundleName, now, meta.harness || GLOBAL_HARNESS);
-            if (entry)
-                out.push({ name: bundleName, entry });
-        }
-    }
-    catch {
-        /* best-effort */
-    }
-    return out;
-}
-/** On a SLEEP event: delete every non-`--durable` session (blob + index entry),
- * keep the durable ones. Default bundles thus re-lock on sleep. */
-export function pruneSessionsOnSleep() {
-    if (!shouldPersist())
-        return;
-    try {
-        const { survivors, deletedNames } = pruneOnSleep(readIndex());
-        for (const name of deletedNames) {
-            const meta = readIndex().bundles[name];
-            try {
-                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || GLOBAL_HARNESS));
-            }
-            catch { /* keep going */ }
-        }
-        writeIndex(survivors);
-    }
-    catch {
-        /* best-effort */
-    }
-}

package/dist/lib/secrets/sync-backend.d.ts

@@ -1,48 +0,0 @@
-/**
- * Transport seam for encrypted secrets-bundle sync.
- *
- * A `SyncBackend` moves opaque ciphertext envelopes to and from some remote.
- * It NEVER sees plaintext: encryption (`encryptBlob`) happens in `sync.ts`
- * before `putEnvelope`, and decryption (`decryptBlob`) happens after
- * `getEnvelope`. This mirrors the `KeychainBackend` storage seam
- * (`src/lib/secrets/index.ts`) but abstracts *transport* rather than at-rest
- * storage — so the high-level push/pull logic in `sync.ts` is decoupled from
- * any specific backend (Rush's api.prix.dev, a future Supabase driver, an
- * in-memory test double, …).
- */
-/** Encrypted bundle envelope (AES-256-GCM, key via PBKDF2-SHA256). All byte
- *  fields are base64. The server only ever stores/returns this — never plaintext. */
-export interface EncryptedEnvelope {
-    v: 1;
-    kdf: 'pbkdf2-sha256';
-    iter: number;
-    salt: string;
-    iv: string;
-    ct: string;
-    tag: string;
-}
-/** A stored bundle object: the ciphertext envelope plus a last-updated stamp. */
-export interface SyncEnvelope {
-    envelope: EncryptedEnvelope;
-    updated_at: string;
-}
-/** Lightweight listing entry returned by `listEnvelopes`. */
-export interface RemoteBundleSummary {
-    name: string;
-    updated_at: string;
-}
-/**
- * Pluggable transport for encrypted bundles. Implementations handle only the
- * wire/storage; the crypto and bundle snapshot/restore stay backend-agnostic
- * in `sync.ts`.
- */
-export interface SyncBackend {
-    /** Store (create or overwrite) the envelope for `name`. */
-    putEnvelope(name: string, payload: SyncEnvelope): Promise<void>;
-    /** Fetch the envelope for `name`, or `null` if the remote has none. */
-    getEnvelope(name: string): Promise<SyncEnvelope | null>;
-    /** Delete `name` on the remote. Returns false if it didn't exist. */
-    deleteEnvelope(name: string): Promise<boolean>;
-    /** List every bundle the authenticated user has on the remote. */
-    listEnvelopes(): Promise<RemoteBundleSummary[]>;
-}

package/dist/lib/secrets/sync-backend.js

@@ -1,13 +0,0 @@
-/**
- * Transport seam for encrypted secrets-bundle sync.
- *
- * A `SyncBackend` moves opaque ciphertext envelopes to and from some remote.
- * It NEVER sees plaintext: encryption (`encryptBlob`) happens in `sync.ts`
- * before `putEnvelope`, and decryption (`decryptBlob`) happens after
- * `getEnvelope`. This mirrors the `KeychainBackend` storage seam
- * (`src/lib/secrets/index.ts`) but abstracts *transport* rather than at-rest
- * storage — so the high-level push/pull logic in `sync.ts` is decoupled from
- * any specific backend (Rush's api.prix.dev, a future Supabase driver, an
- * in-memory test double, …).
- */
-export {};

package/dist/lib/secrets/sync-commands.d.ts

@@ -1,21 +0,0 @@
-/**
- * The argv tokens for the synchronous secrets-broker clients: the tokens
- * `agentGetSync`/`agentReachableSync`/`agentEvictSync` spawn, and the tokens
- * `index.ts` dispatches on before commander.
- *
- * This is a LEAF module — it imports nothing, so the CLI entrypoint can bind
- * these statically without dragging the secrets graph (and its `state.js` /
- * `install-helper.js` / `session-store.js` imports) into every invocation. That
- * is the whole reason the file exists: with the tokens in `agent.ts`, `index.ts`
- * had to repeat them as string literals, and the two could silently drift —
- * a drift with no visible failure mode, because the CLI answers "unknown
- * command", the client reads the non-zero exit as "broker down", and every
- * secret read falls back to a Touch ID prompt. Exactly the bug this subsystem
- * was fixed for. Sharing one binding makes that divergence a type error rather
- * than something a test has to notice.
- *
- * Same leaf discipline, and same motivation, as `lib/cli-entry.ts`.
- */
-export declare const SYNC_GET_CMD = "__secrets-get";
-export declare const SYNC_PING_CMD = "__secrets-ping";
-export declare const SYNC_LOCK_CMD = "__secrets-lock";

package/dist/lib/secrets/sync-commands.js

@@ -1,21 +0,0 @@
-/**
- * The argv tokens for the synchronous secrets-broker clients: the tokens
- * `agentGetSync`/`agentReachableSync`/`agentEvictSync` spawn, and the tokens
- * `index.ts` dispatches on before commander.
- *
- * This is a LEAF module — it imports nothing, so the CLI entrypoint can bind
- * these statically without dragging the secrets graph (and its `state.js` /
- * `install-helper.js` / `session-store.js` imports) into every invocation. That
- * is the whole reason the file exists: with the tokens in `agent.ts`, `index.ts`
- * had to repeat them as string literals, and the two could silently drift —
- * a drift with no visible failure mode, because the CLI answers "unknown
- * command", the client reads the non-zero exit as "broker down", and every
- * secret read falls back to a Touch ID prompt. Exactly the bug this subsystem
- * was fixed for. Sharing one binding makes that divergence a type error rather
- * than something a test has to notice.
- *
- * Same leaf discipline, and same motivation, as `lib/cli-entry.ts`.
- */
-export const SYNC_GET_CMD = '__secrets-get';
-export const SYNC_PING_CMD = '__secrets-ping';
-export const SYNC_LOCK_CMD = '__secrets-lock';

package/dist/lib/secrets/sync.d.ts

@@ -1,48 +0,0 @@
-/**
- * Remote sync for secrets bundles — backend-agnostic.
- *
- * Replaces the previous "leave it to iCloud Keychain" model with explicit
- * push/pull. Bundle contents (vars + secret values) are encrypted client-side
- * with AES-256-GCM under a key derived from a user-supplied passphrase via
- * PBKDF2-SHA256; only the resulting ciphertext envelope is handed to the
- * transport. The transport itself is a pluggable `SyncBackend` (see
- * `sync-backend.ts`) — the Rush driver (`drivers/rush.ts`, api.prix.dev) is the
- * default for backwards compatibility, swappable via `setSyncBackend`. Plaintext
- * never leaves this module; the backend only ever sees ciphertext + KDF params.
- */
-import { type SecretsBundle } from './bundles.js';
-import type { SyncBackend, RemoteBundleSummary, EncryptedEnvelope } from './sync-backend.js';
-export type { EncryptedEnvelope, RemoteBundleSummary } from './sync-backend.js';
-export declare const MIN_PASSPHRASE_LEN = 12;
-/** Override the sync transport. Returns the previous backend (restore in tests). */
-export declare function setSyncBackend(next: SyncBackend): SyncBackend;
-/** Encrypt a JSON-serializable payload with a passphrase. */
-export declare function encryptBlob(plaintext: string, passphrase: string): EncryptedEnvelope;
-/** Decrypt an envelope. Throws on bad passphrase (auth tag mismatch). */
-export declare function decryptBlob(envelope: EncryptedEnvelope, passphrase: string): string;
-/** The plaintext we serialize before encrypting: bundle metadata + secret values. */
-export interface BundleSnapshot {
-    bundle: SecretsBundle;
-    /** keychain shortId -> plaintext value. Only present for keychain: refs. */
-    secrets: Record<string, string>;
-}
-/** Options for pushBundle. */
-export interface PushOptions {
-    passphrase: string;
-}
-/** Push a local bundle to the remote. Encrypts client-side; the backend only sees ciphertext. */
-export declare function pushBundle(name: string, opts: PushOptions): Promise<{
-    updated_at: string;
-}>;
-/** Options for pullBundle. */
-export interface PullOptions {
-    passphrase: string;
-    /** When true, overwrite an existing local bundle. */
-    force?: boolean;
-}
-/** Pull a bundle by name from the remote and materialize it locally. */
-export declare function pullBundle(name: string, opts: PullOptions): Promise<SecretsBundle>;
-/** Delete a bundle on the remote. */
-export declare function deleteRemoteBundle(name: string): Promise<boolean>;
-/** List bundles currently stored on the remote for this user. */
-export declare function listRemoteBundles(): Promise<RemoteBundleSummary[]>;