@push.rocks/smartsecret 1.0.2 → 1.1.0

package/.smartconfig.json

@@ -0,0 +1,48 @@
+{
+  "@git.zone/cli": {
+    "schemaVersion": 2,
+    "projectType": "npm",
+    "module": {
+      "githost": "code.foss.global",
+      "gitscope": "push.rocks",
+      "gitrepo": "smartsecret",
+      "description": "OS keychain-based secret storage with encrypted-file fallback for Node.js.",
+      "npmPackagename": "@push.rocks/smartsecret",
+      "license": "MIT"
+    },
+    "commit": {
+      "confirmation": "prompt",
+      "steps": ["analyze", "test", "build", "changelog", "commit", "push"]
+    },
+    "release": {
+      "confirmation": "prompt",
+      "preflight": {
+        "requireCleanTree": true,
+        "test": true,
+        "build": true
+      },
+      "targets": {
+        "git": {
+          "enabled": true,
+          "remote": "origin",
+          "pushBranch": true,
+          "pushTags": true
+        },
+        "npm": {
+          "enabled": true,
+          "registries": [
+            "https://registry.npmjs.org",
+            "https://verdaccio.lossless.digital"
+          ],
+          "accessLevel": "public",
+          "alreadyPublished": "success"
+        },
+        "docker": {
+          "enabled": false,
+          "engine": "tsdocker",
+          "patterns": []
+        }
+      }
+    }
+  }
+}

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartsecret',
-    version: '1.0.2',
+    version: '1.1.0',
     description: 'OS keychain-based secret storage with encrypted-file fallback for Node.js.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDRFQUE0RTtDQUMxRixDQUFBIn0=

package/dist_ts/index.d.ts

@@ -3,3 +3,7 @@ export type { ISecretBackend, TBackendType } from './smartsecret.backends.base.j
 export { MacosKeychainBackend } from './smartsecret.backends.macos.js';
 export { LinuxSecretServiceBackend } from './smartsecret.backends.linux.js';
 export { FileEncryptedBackend } from './smartsecret.backends.file.js';
+export * from './smartsecret.keyring.js';
+export { SmartSecretKeyringError } from './smartsecret.keyring.error.js';
+export type { ISmartSecretKeyringErrorJson, TSmartSecretKeyringErrorCode, } from './smartsecret.keyring.error.js';
+export type { ISmartSecretEnvelopeV1, TSmartSecretKeyringProfile, } from './smartsecret.keyring.protocol.js';

package/dist_ts/index.js

@@ -2,4 +2,6 @@ export * from './smartsecret.classes.smartsecret.js';
 export { MacosKeychainBackend } from './smartsecret.backends.macos.js';
 export { LinuxSecretServiceBackend } from './smartsecret.backends.linux.js';
 export { FileEncryptedBackend } from './smartsecret.backends.file.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLHNDQUFzQyxDQUFDO0FBRXJELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3ZFLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGdDQUFnQyxDQUFDIn0=
+export * from './smartsecret.keyring.js';
+export { SmartSecretKeyringError } from './smartsecret.keyring.error.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLHNDQUFzQyxDQUFDO0FBRXJELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3ZFLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQ3RFLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsT0FBTyxFQUFFLHVCQUF1QixFQUFFLE1BQU0sZ0NBQWdDLENBQUMifQ==

package/dist_ts/smartsecret.keyring.d.ts

@@ -0,0 +1,81 @@
+import { type ISmartSecretEnvelopeV1 } from './smartsecret.keyring.protocol.js';
+export type TSmartSecretKekStatus = 'active' | 'retired' | 'revoked';
+export interface ISmartSecretKekDescriptor {
+    version: number;
+    status: TSmartSecretKekStatus;
+    credentialPath?: string;
+    expectedFingerprint?: `sha256:${string}`;
+    createdAt: number;
+    activatedAt: number;
+    retiredAt?: number;
+    revokedAt?: number;
+    escrowReference?: string;
+    escrowedAt?: number;
+    recoveryTestedAt?: number;
+}
+export interface ISmartSecretKeyringConfig {
+    keyringId: string;
+    keys: readonly ISmartSecretKekDescriptor[];
+}
+export interface ISmartSecretKekInspection {
+    version: number;
+    status: TSmartSecretKekStatus;
+    expectedFingerprint?: `sha256:${string}`;
+    createdAt: number;
+    activatedAt: number;
+    retiredAt?: number;
+    revokedAt?: number;
+    escrowReference?: string;
+    escrowedAt?: number;
+    recoveryTestedAt?: number;
+}
+export interface ISmartSecretKeyringInspection {
+    keyringId: string;
+    activeVersion: number;
+    keys: ISmartSecretKekInspection[];
+}
+export interface IEncryptSmartSecretEnvelopeOptions {
+    envelopeId: string;
+    plaintext: Uint8Array;
+    context: Uint8Array;
+    createdAt?: number;
+}
+export interface IDecryptSmartSecretEnvelopeOptions {
+    envelope: unknown;
+    expectedEnvelopeId: string;
+    context: Uint8Array;
+}
+export interface IRewrapSmartSecretEnvelopeOptions {
+    envelope: unknown;
+    expectedEnvelopeId: string;
+    context: Uint8Array;
+    targetVersion?: number;
+}
+export interface ISmartSecretRecoverySelfTestResult {
+    keyringId: string;
+    version: number;
+    status: 'active' | 'retired';
+    fingerprint: `sha256:${string}`;
+    testedAt: number;
+}
+/**
+ * A Linux-only, immutable KEK snapshot for strict DEK/KEK envelopes.
+ * Envelope persistence and compare-and-swap coordination remain consumer responsibilities.
+ */
+export declare class SmartSecretKeyring {
+    private readonly keyringId;
+    private readonly descriptors;
+    private readonly activeVersion;
+    private readonly loadedKeys;
+    private destroyed;
+    private constructor();
+    static create(configArg: ISmartSecretKeyringConfig): Promise<SmartSecretKeyring>;
+    private requireAlive;
+    private requireEnvelopeKey;
+    inspect(): ISmartSecretKeyringInspection;
+    destroy(): void;
+    encryptEnvelope(optionsArg: IEncryptSmartSecretEnvelopeOptions): Promise<ISmartSecretEnvelopeV1>;
+    decryptEnvelope(optionsArg: IDecryptSmartSecretEnvelopeOptions): Promise<Uint8Array>;
+    rewrapEnvelope(optionsArg: IRewrapSmartSecretEnvelopeOptions): Promise<ISmartSecretEnvelopeV1>;
+    recoverySelfTest(versionArg: number): Promise<ISmartSecretRecoverySelfTestResult>;
+}

package/dist_ts/smartsecret.keyring.error.d.ts

@@ -0,0 +1,17 @@
+export type TSmartSecretKeyringErrorCode = 'AUTHENTICATION_FAILED' | 'CONFIG_INVALID' | 'CONTEXT_MISMATCH' | 'CRYPTO_OPERATION_FAILED' | 'CREDENTIAL_FILE_INVALID' | 'DESTROYED' | 'ENVELOPE_ID_MISMATCH' | 'ENVELOPE_INVALID' | 'KEK_FINGERPRINT_MISMATCH' | 'KEK_UNAVAILABLE' | 'INVALID_ARGUMENT' | 'PLATFORM_UNSUPPORTED' | 'SIZE_LIMIT_EXCEEDED' | 'TARGET_VERSION_MISMATCH';
+export interface ISmartSecretKeyringErrorJson {
+    name: 'SmartSecretKeyringError';
+    code: TSmartSecretKeyringErrorCode;
+    message: string;
+}
+declare const inspectSymbol: unique symbol;
+/** A code-only error that intentionally retains no operation values or causes. */
+export declare class SmartSecretKeyringError extends Error {
+    readonly code: TSmartSecretKeyringErrorCode;
+    readonly cause: undefined;
+    constructor(codeArg: TSmartSecretKeyringErrorCode);
+    toJSON(): ISmartSecretKeyringErrorJson;
+    [inspectSymbol](): ISmartSecretKeyringErrorJson;
+}
+export declare const createSmartSecretKeyringError: (codeArg: TSmartSecretKeyringErrorCode) => SmartSecretKeyringError;
+export {};

package/dist_ts/smartsecret.keyring.error.js

@@ -0,0 +1,46 @@
+const inspectSymbol = Symbol.for('nodejs.util.inspect.custom');
+const errorCodes = new Set([
+    'AUTHENTICATION_FAILED',
+    'CONFIG_INVALID',
+    'CONTEXT_MISMATCH',
+    'CRYPTO_OPERATION_FAILED',
+    'CREDENTIAL_FILE_INVALID',
+    'DESTROYED',
+    'ENVELOPE_ID_MISMATCH',
+    'ENVELOPE_INVALID',
+    'KEK_FINGERPRINT_MISMATCH',
+    'KEK_UNAVAILABLE',
+    'INVALID_ARGUMENT',
+    'PLATFORM_UNSUPPORTED',
+    'SIZE_LIMIT_EXCEEDED',
+    'TARGET_VERSION_MISMATCH',
+]);
+/** A code-only error that intentionally retains no operation values or causes. */
+export class SmartSecretKeyringError extends Error {
+    constructor(codeArg) {
+        const code = errorCodes.has(codeArg) ? codeArg : 'INVALID_ARGUMENT';
+        const message = `SmartSecret keyring operation failed (${code}).`;
+        super(message);
+        this.name = 'SmartSecretKeyringError';
+        this.code = code;
+        this.stack = `${this.name}: ${message}`;
+        Object.defineProperty(this, 'cause', {
+            configurable: false,
+            enumerable: false,
+            value: undefined,
+            writable: false,
+        });
+    }
+    toJSON() {
+        return {
+            name: 'SmartSecretKeyringError',
+            code: this.code,
+            message: this.message,
+        };
+    }
+    [inspectSymbol]() {
+        return this.toJSON();
+    }
+}
+export const createSmartSecretKeyringError = (codeArg) => new SmartSecretKeyringError(codeArg);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQua2V5cmluZy5lcnJvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LmtleXJpbmcuZXJyb3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBc0JBLE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsNEJBQTRCLENBQUMsQ0FBQztBQUMvRCxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDdkQsdUJBQXVCO0lBQ3ZCLGdCQUFnQjtJQUNoQixrQkFBa0I7SUFDbEIseUJBQXlCO0lBQ3pCLHlCQUF5QjtJQUN6QixXQUFXO0lBQ1gsc0JBQXNCO0lBQ3RCLGtCQUFrQjtJQUNsQiwwQkFBMEI7SUFDMUIsaUJBQWlCO0lBQ2pCLGtCQUFrQjtJQUNsQixzQkFBc0I7SUFDdEIscUJBQXFCO0lBQ3JCLHlCQUF5QjtDQUMxQixDQUFDLENBQUM7QUFFSCxrRkFBa0Y7QUFDbEYsTUFBTSxPQUFPLHVCQUF3QixTQUFRLEtBQUs7SUFJaEQsWUFBWSxPQUFxQztRQUMvQyxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDO1FBQ3BFLE1BQU0sT0FBTyxHQUFHLHlDQUF5QyxJQUFJLElBQUksQ0FBQztRQUNsRSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLHlCQUF5QixDQUFDO1FBQ3RDLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO1FBQ2pCLElBQUksQ0FBQyxLQUFLLEdBQUcsR0FBRyxJQUFJLENBQUMsSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3hDLE1BQU0sQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRTtZQUNuQyxZQUFZLEVBQUUsS0FBSztZQUNuQixVQUFVLEVBQUUsS0FBSztZQUNqQixLQUFLLEVBQUUsU0FBUztZQUNoQixRQUFRLEVBQUUsS0FBSztTQUNoQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sTUFBTTtRQUNYLE9BQU87WUFDTCxJQUFJLEVBQUUseUJBQXlCO1lBQy9CLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtZQUNmLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztTQUN0QixDQUFDO0lBQ0osQ0FBQztJQUVNLENBQUMsYUFBYSxDQUFDO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3ZCLENBQUM7Q0FDRjtBQUVELE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQzNDLE9BQXFDLEVBQ1osRUFBRSxDQUFDLElBQUksdUJBQXVCLENBQUMsT0FBTyxDQUFDLENBQUMifQ==