@secfn/core 0.0.1

package/dist/scanning/patterns.js

@@ -0,0 +1,139 @@
+export const DEFAULT_PATTERNS = [
+    {
+        name: 'AWS Access Key',
+        pattern: /AKIA[0-9A-Z]{16}/g,
+        entropy: 4.5,
+        description: 'AWS Access Key ID',
+        severity: 'critical',
+    },
+    {
+        name: 'AWS Secret Key',
+        pattern: /aws[_-]?secret[_-]?access[_-]?key[=:\s]+['"]?([a-zA-Z0-9/+=]{40})['"]?/gi,
+        entropy: 5.0,
+        description: 'AWS Secret Access Key',
+        severity: 'critical',
+    },
+    {
+        name: 'Generic API Key',
+        pattern: /api[_-]?key[_-]?[=:]\s*['"]?([a-zA-Z0-9]{32,})['"]?/gi,
+        entropy: 4.0,
+        description: 'Generic API key pattern',
+        severity: 'high',
+    },
+    {
+        name: 'Private Key',
+        pattern: /-----BEGIN (RSA|OPENSSH|DSA|EC|PGP) PRIVATE KEY-----/g,
+        description: 'Private cryptographic key',
+        severity: 'critical',
+    },
+    {
+        name: 'JWT Token',
+        pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,
+        description: 'JSON Web Token',
+        severity: 'high',
+    },
+    {
+        name: 'GitHub Token',
+        pattern: /ghp_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}/g,
+        entropy: 4.5,
+        description: 'GitHub Personal Access Token',
+        severity: 'critical',
+    },
+    {
+        name: 'Stripe API Key',
+        pattern: /sk_live_[a-zA-Z0-9]{24,}|rk_live_[a-zA-Z0-9]{24,}/g,
+        entropy: 4.5,
+        description: 'Stripe API Key',
+        severity: 'critical',
+    },
+    {
+        name: 'Google API Key',
+        pattern: /AIza[0-9A-Za-z_-]{35}/g,
+        entropy: 4.5,
+        description: 'Google API Key',
+        severity: 'high',
+    },
+    {
+        name: 'Slack Token',
+        pattern: /xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}/g,
+        entropy: 4.5,
+        description: 'Slack API Token',
+        severity: 'high',
+    },
+    {
+        name: 'OpenAI API Key',
+        pattern: /sk-[a-zA-Z0-9]{48}/g,
+        entropy: 4.5,
+        description: 'OpenAI API Key',
+        severity: 'critical',
+    },
+    {
+        name: 'Anthropic API Key',
+        pattern: /sk-ant-[a-zA-Z0-9_-]{95,}/g,
+        entropy: 4.5,
+        description: 'Anthropic API Key',
+        severity: 'critical',
+    },
+    {
+        name: 'Database Connection String',
+        pattern: /(postgres|mysql|mongodb):\/\/[^\s'"<>]+:[^\s'"<>]+@[^\s'"<>]+/gi,
+        description: 'Database connection string with credentials',
+        severity: 'critical',
+    },
+    {
+        name: 'Password in Code',
+        pattern: /(password|passwd|pwd)[=:\s]+['"]([^'"]{8,})['"]/gi,
+        entropy: 3.5,
+        description: 'Hardcoded password',
+        severity: 'high',
+    },
+    {
+        name: 'Bearer Token',
+        pattern: /Bearer\s+[a-zA-Z0-9_\-\.]{20,}/gi,
+        entropy: 4.0,
+        description: 'Bearer authentication token',
+        severity: 'high',
+    },
+    {
+        name: 'NPM Token',
+        pattern: /npm_[a-zA-Z0-9]{36}/g,
+        entropy: 4.5,
+        description: 'NPM Access Token',
+        severity: 'high',
+    },
+    {
+        name: 'Twilio API Key',
+        pattern: /SK[a-f0-9]{32}/g,
+        entropy: 4.5,
+        description: 'Twilio API Key',
+        severity: 'high',
+    },
+    {
+        name: 'SendGrid API Key',
+        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+        entropy: 4.5,
+        description: 'SendGrid API Key',
+        severity: 'high',
+    },
+    {
+        name: 'Mailgun API Key',
+        pattern: /key-[a-f0-9]{32}/g,
+        entropy: 4.0,
+        description: 'Mailgun API Key',
+        severity: 'high',
+    },
+    {
+        name: 'Azure Storage Key',
+        pattern: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[^;]+/gi,
+        description: 'Azure Storage Connection String',
+        severity: 'critical',
+    },
+    {
+        name: 'Generic Secret',
+        pattern: /(secret|token|api[_-]?key|auth[_-]?token)[=:\s]+['"]([a-zA-Z0-9_\-\/.+=]{20,})['"]/gi,
+        entropy: 3.5,
+        description: 'Generic secret pattern',
+        severity: 'medium',
+    },
+];
+//# sourceMappingURL=patterns.js.map

package/dist/scanning/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/scanning/patterns.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,mBAAmB;QAChC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,0EAA0E;QACnF,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,uBAAuB;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,uDAAuD;QAChE,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iEAAiE;QAC1E,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,wDAAwD;QACjE,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,iBAAiB;QAC9B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,4BAA4B;QACrC,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,mBAAmB;QAChC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,oBAAoB;QACjC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,kCAAkC;QAC3C,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,kBAAkB;QAC/B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,2CAA2C;QACpD,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,kBAAkB;QAC/B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,iBAAiB;QAC9B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,qEAAqE;QAC9E,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sFAAsF;QAC/F,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,wBAAwB;QACrC,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC"}

package/dist/scanning/scanner.d.ts

@@ -0,0 +1,36 @@
+import type { SecretPattern, SecretScanResult } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+export interface SecretScannerConfig {
+    patterns?: SecretPattern[];
+    excludePaths?: string[];
+    minEntropy?: number;
+    maxFileSize?: number;
+    storage?: IndexedDBStorage;
+}
+export interface ScanOptions {
+    saveResults?: boolean;
+}
+export interface GitScanOptions {
+    branch?: string;
+    commits?: number;
+}
+export declare class SecretScanner {
+    private patterns;
+    private excludePaths;
+    private minEntropy;
+    private maxFileSize;
+    private storage?;
+    private git;
+    constructor(config?: SecretScannerConfig);
+    scanDirectory(dir: string, options?: ScanOptions): Promise<SecretScanResult[]>;
+    scanFile(filePath: string): Promise<SecretScanResult[]>;
+    scanContent(content: string, filePath: string): SecretScanResult[];
+    scanGitHistory(options?: GitScanOptions): Promise<SecretScanResult[]>;
+    addPattern(pattern: SecretPattern): void;
+    removePattern(name: string): void;
+    getPatterns(): SecretPattern[];
+    private getLineAndColumn;
+    private getContext;
+    getScanHistory(limit?: number): Promise<SecretScanResult[]>;
+}
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanning/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/scanning/scanner.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAIxE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,YAAY,CAAW;IAC/B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAY;gBAEX,MAAM,GAAE,mBAAwB;IAStC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA4BlF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAgB7D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE;IA2C5D,cAAc,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAoC/E,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIjC,WAAW,IAAI,aAAa,EAAE;IAI9B,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,UAAU;IAMZ,cAAc,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAM/D"}

package/dist/scanning/scanner.js

@@ -0,0 +1,152 @@
+import { readFile } from 'fs/promises';
+import { glob } from 'glob';
+import simpleGit from 'simple-git';
+import { DEFAULT_PATTERNS } from './patterns.js';
+import { generateId, calculateEntropy, redactSecret } from '../utils/helpers.js';
+export class SecretScanner {
+    patterns;
+    excludePaths;
+    minEntropy;
+    maxFileSize;
+    storage;
+    git;
+    constructor(config = {}) {
+        this.patterns = config.patterns || DEFAULT_PATTERNS;
+        this.excludePaths = config.excludePaths || ['node_modules/**', 'dist/**', 'build/**', '.git/**'];
+        this.minEntropy = config.minEntropy || 3.0;
+        this.maxFileSize = config.maxFileSize || 1024 * 1024;
+        this.storage = config.storage;
+        this.git = simpleGit();
+    }
+    async scanDirectory(dir, options = {}) {
+        const files = await glob('**/*', {
+            cwd: dir,
+            absolute: true,
+            nodir: true,
+            ignore: this.excludePaths,
+        });
+        const results = [];
+        for (const file of files) {
+            try {
+                const fileResults = await this.scanFile(file);
+                results.push(...fileResults);
+            }
+            catch (error) {
+                console.error(`[SecFn] Error scanning file ${file}:`, error);
+            }
+        }
+        if (options.saveResults && this.storage) {
+            for (const result of results) {
+                await this.storage.saveScanResult(result);
+            }
+        }
+        return results;
+    }
+    async scanFile(filePath) {
+        try {
+            const content = await readFile(filePath, 'utf-8');
+            if (content.length > this.maxFileSize) {
+                console.warn(`[SecFn] Skipping large file: ${filePath}`);
+                return [];
+            }
+            return this.scanContent(content, filePath);
+        }
+        catch (error) {
+            console.error(`[SecFn] Error reading file ${filePath}:`, error);
+            return [];
+        }
+    }
+    scanContent(content, filePath) {
+        const results = [];
+        const lines = content.split('\n');
+        for (const pattern of this.patterns) {
+            const matches = content.matchAll(pattern.pattern);
+            for (const match of matches) {
+                if (!match[0] || !match.index)
+                    continue;
+                const matchedSecret = match[1] || match[0];
+                const entropy = calculateEntropy(matchedSecret);
+                if (pattern.entropy && entropy < Math.min(pattern.entropy, this.minEntropy)) {
+                    continue;
+                }
+                const { line, column } = this.getLineAndColumn(content, match.index);
+                const context = this.getContext(lines, line);
+                const result = {
+                    id: generateId('scan'),
+                    timestamp: Date.now(),
+                    file: filePath,
+                    line,
+                    column,
+                    pattern: pattern.name,
+                    match: matchedSecret,
+                    redactedMatch: redactSecret(matchedSecret),
+                    severity: pattern.severity,
+                    entropy,
+                    context,
+                    resolved: false,
+                    falsePositive: false,
+                };
+                results.push(result);
+            }
+        }
+        return results;
+    }
+    async scanGitHistory(options = {}) {
+        const branch = options.branch || 'HEAD';
+        const commitCount = options.commits || 100;
+        const log = await this.git.log([branch, `-n`, `${commitCount}`]);
+        const results = [];
+        for (const commit of log.all) {
+            try {
+                const diff = await this.git.show([commit.hash]);
+                const commitResults = this.scanContent(diff, `commit:${commit.hash.substring(0, 7)}`);
+                for (const result of commitResults) {
+                    result.metadata = {
+                        commit: commit.hash,
+                        author: commit.author_name,
+                        date: commit.date,
+                        message: commit.message,
+                    };
+                }
+                results.push(...commitResults);
+            }
+            catch (error) {
+                console.error(`[SecFn] Error scanning commit ${commit.hash}:`, error);
+            }
+        }
+        if (this.storage) {
+            for (const result of results) {
+                await this.storage.saveScanResult(result);
+            }
+        }
+        return results;
+    }
+    addPattern(pattern) {
+        this.patterns.push(pattern);
+    }
+    removePattern(name) {
+        this.patterns = this.patterns.filter(p => p.name !== name);
+    }
+    getPatterns() {
+        return [...this.patterns];
+    }
+    getLineAndColumn(content, index) {
+        const beforeMatch = content.substring(0, index);
+        const lines = beforeMatch.split('\n');
+        const line = lines.length;
+        const column = lines[lines.length - 1].length + 1;
+        return { line, column };
+    }
+    getContext(lines, lineNumber, contextLines = 2) {
+        const start = Math.max(0, lineNumber - contextLines - 1);
+        const end = Math.min(lines.length, lineNumber + contextLines);
+        return lines.slice(start, end).join('\n');
+    }
+    async getScanHistory(limit = 100) {
+        if (!this.storage) {
+            throw new Error('Storage not configured');
+        }
+        return await this.storage.getScanHistory(limit);
+    }
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanning/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/scanning/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,SAA6B,MAAM,YAAY,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAmBjF,MAAM,OAAO,aAAa;IAChB,QAAQ,CAAkB;IAC1B,YAAY,CAAW;IACvB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,OAAO,CAAoB;IAC3B,GAAG,CAAY;IAEvB,YAAY,SAA8B,EAAE;QAC1C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACjG,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,GAAG,IAAI,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,UAAuB,EAAE;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;YAC/B,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAElD,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;gBACzD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;YAChE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,QAAgB;QAC3C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAElD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;oBAAE,SAAS;gBAExC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAEhD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5E,SAAS;gBACX,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAE7C,MAAM,MAAM,GAAqB;oBAC/B,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,IAAI,EAAE,QAAQ;oBACd,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC;oBAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,KAAK;oBACf,aAAa,EAAE,KAAK;iBACrB,CAAC;gBAEF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAA0B,EAAE;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAEtF,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;oBACnC,MAAM,CAAC,QAAQ,GAAG;wBAChB,MAAM,EAAE,MAAM,CAAC,IAAI;wBACnB,MAAM,EAAE,MAAM,CAAC,WAAW;wBAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;qBACxB,CAAC;gBACJ,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,UAAU,CAAC,OAAsB;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,KAAa;QACrD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAElD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAEO,UAAU,CAAC,KAAe,EAAE,UAAkB,EAAE,YAAY,GAAG,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAK,GAAG,GAAG;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;CACF"}

package/dist/secrets/encryption.d.ts

@@ -0,0 +1,17 @@
+export interface EncryptedData {
+    iv: string;
+    encrypted: string;
+    authTag: string;
+}
+export declare class SecretEncryption {
+    private algorithm;
+    private keyLength;
+    private ivLength;
+    private salt;
+    private iterations;
+    encrypt(plaintext: string, masterKey: string): Promise<string>;
+    decrypt(ciphertext: string, masterKey: string): Promise<string>;
+    private deriveKey;
+    isEncrypted(value: string): boolean;
+}
+//# sourceMappingURL=encryption.d.ts.map

package/dist/secrets/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/secrets/encryption.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,IAAI,CAAmB;IAC/B,OAAO,CAAC,UAAU,CAAU;IAEtB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB9D,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrE,OAAO,CAAC,SAAS;IAUjB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAapC"}

package/dist/secrets/encryption.js

@@ -0,0 +1,47 @@
+import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from 'crypto';
+export class SecretEncryption {
+    algorithm = 'aes-256-gcm';
+    keyLength = 32;
+    ivLength = 16;
+    salt = 'secfn-salt-v1';
+    iterations = 100000;
+    async encrypt(plaintext, masterKey) {
+        const key = this.deriveKey(masterKey);
+        const iv = randomBytes(this.ivLength);
+        const cipher = createCipheriv(this.algorithm, key, iv);
+        let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        const data = {
+            iv: iv.toString('hex'),
+            encrypted,
+            authTag: authTag.toString('hex'),
+        };
+        return JSON.stringify(data);
+    }
+    async decrypt(ciphertext, masterKey) {
+        const key = this.deriveKey(masterKey);
+        const data = JSON.parse(ciphertext);
+        const decipher = createDecipheriv(this.algorithm, key, Buffer.from(data.iv, 'hex'));
+        decipher.setAuthTag(Buffer.from(data.authTag, 'hex'));
+        let decrypted = decipher.update(data.encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    deriveKey(masterKey) {
+        return pbkdf2Sync(masterKey, this.salt, this.iterations, this.keyLength, 'sha256');
+    }
+    isEncrypted(value) {
+        try {
+            const parsed = JSON.parse(value);
+            return (typeof parsed === 'object' &&
+                'iv' in parsed &&
+                'encrypted' in parsed &&
+                'authTag' in parsed);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=encryption.js.map

package/dist/secrets/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/secrets/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAQnF,MAAM,OAAO,gBAAgB;IACnB,SAAS,GAAG,aAAa,CAAC;IAC1B,SAAS,GAAG,EAAE,CAAC;IACf,QAAQ,GAAG,EAAE,CAAC;IACd,IAAI,GAAG,eAAe,CAAC;IACvB,UAAU,GAAG,MAAM,CAAC;IAE5B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,SAAiB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAQ,CAAC;QAE9D,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,MAAM,IAAI,GAAkB;YAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;SACjC,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,SAAS,EACd,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CACrB,CAAC;QACT,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAEtD,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,SAAS,CAAC,SAAiB;QACjC,OAAO,UAAU,CACf,SAAS,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,EACd,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;gBAC1B,IAAI,IAAI,MAAM;gBACd,WAAW,IAAI,MAAM;gBACrB,SAAS,IAAI,MAAM,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/secrets/vault.d.ts

@@ -0,0 +1,43 @@
+import type { Secret, SecretAccess, Environment } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+export interface SecretsVaultConfig {
+    storage: IndexedDBStorage;
+    encryption: {
+        algorithm: 'AES-256-GCM';
+        masterKey: string;
+        keyDerivation?: 'PBKDF2' | 'scrypt';
+    };
+    rotation?: {
+        checkInterval: number;
+        notifyBefore: number;
+    };
+}
+export interface SetSecretOptions {
+    tags?: string[];
+    environment?: Environment;
+    expiresAt?: number;
+    rotateEvery?: number;
+    createdBy?: string;
+}
+export declare class SecretsVault {
+    private storage;
+    private encryption;
+    private masterKey;
+    private rotationInterval?;
+    constructor(config: SecretsVaultConfig);
+    set(key: string, value: string, options?: SetSecretOptions): Promise<string>;
+    get(key: string, userId?: string): Promise<string | null>;
+    list(filter?: {
+        environment?: Environment;
+        tags?: string[];
+    }): Promise<Array<Omit<Secret, 'value'>>>;
+    rotate(key: string, newValue: string, userId?: string): Promise<void>;
+    delete(key: string, userId?: string): Promise<void>;
+    getAccessLog(key: string, limit?: number): Promise<SecretAccess[]>;
+    getSecretsNeedingRotation(beforeMs?: number): Promise<Secret[]>;
+    getExpiredSecrets(): Promise<Secret[]>;
+    private logAccess;
+    private startRotationCheck;
+    stop(): void;
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/secrets/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/secrets/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAIxE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,EAAE;QACV,SAAS,EAAE,aAAa,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;KACrC,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAiB;gBAE9B,MAAM,EAAE,kBAAkB;IAUhC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;IA+BhF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoB3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAMpG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrD,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAU/D,yBAAyB,CAAC,QAAQ,GAAE,MAAgC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAaxF,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAK9B,SAAS;IAYvB,OAAO,CAAC,kBAAkB;IAW1B,IAAI,IAAI,IAAI;CAKb"}

package/dist/secrets/vault.js

@@ -0,0 +1,126 @@
+import { SecretEncryption } from './encryption.js';
+import { generateId, isExpired } from '../utils/helpers.js';
+export class SecretsVault {
+    storage;
+    encryption;
+    masterKey;
+    rotationInterval;
+    constructor(config) {
+        this.storage = config.storage;
+        this.encryption = new SecretEncryption();
+        this.masterKey = config.encryption.masterKey;
+        if (config.rotation) {
+            this.startRotationCheck(config.rotation.checkInterval, config.rotation.notifyBefore);
+        }
+    }
+    async set(key, value, options = {}) {
+        const existing = await this.storage.getSecretByKey(key);
+        const now = Date.now();
+        const encryptedValue = await this.encryption.encrypt(value, this.masterKey);
+        const secret = {
+            id: existing?.id || generateId('secret'),
+            key,
+            value: encryptedValue,
+            encrypted: true,
+            version: existing ? existing.version + 1 : 1,
+            tags: options.tags || [],
+            environment: options.environment,
+            expiresAt: options.expiresAt,
+            rotateEvery: options.rotateEvery,
+            lastRotated: now,
+            lastAccessed: undefined,
+            accessCount: 0,
+            createdBy: options.createdBy || 'system',
+            createdAt: existing?.createdAt || now,
+            updatedAt: now,
+        };
+        await this.storage.saveSecret(secret);
+        await this.logAccess(secret.id, options.createdBy || 'system', 'write');
+        return secret.id;
+    }
+    async get(key, userId = 'system') {
+        const secret = await this.storage.getSecretByKey(key);
+        if (!secret)
+            return null;
+        if (isExpired(secret.expiresAt)) {
+            throw new Error(`Secret '${key}' has expired`);
+        }
+        const decryptedValue = await this.encryption.decrypt(secret.value, this.masterKey);
+        secret.lastAccessed = Date.now();
+        secret.accessCount += 1;
+        await this.storage.saveSecret(secret);
+        await this.logAccess(secret.id, userId, 'read');
+        return decryptedValue;
+    }
+    async list(filter) {
+        const secrets = await this.storage.listSecrets(filter);
+        return secrets.map(({ value, ...rest }) => rest);
+    }
+    async rotate(key, newValue, userId = 'system') {
+        const secret = await this.storage.getSecretByKey(key);
+        if (!secret) {
+            throw new Error(`Secret '${key}' not found`);
+        }
+        const encryptedValue = await this.encryption.encrypt(newValue, this.masterKey);
+        secret.value = encryptedValue;
+        secret.version += 1;
+        secret.lastRotated = Date.now();
+        secret.updatedAt = Date.now();
+        await this.storage.saveSecret(secret);
+        await this.logAccess(secret.id, userId, 'rotate');
+    }
+    async delete(key, userId = 'system') {
+        const secret = await this.storage.getSecretByKey(key);
+        if (!secret) {
+            throw new Error(`Secret '${key}' not found`);
+        }
+        await this.storage.deleteSecret(secret.id);
+        await this.logAccess(secret.id, userId, 'delete');
+    }
+    async getAccessLog(key, limit = 100) {
+        const secret = await this.storage.getSecretByKey(key);
+        if (!secret) {
+            throw new Error(`Secret '${key}' not found`);
+        }
+        return await this.storage.getSecretAccessLog(secret.id, limit);
+    }
+    async getSecretsNeedingRotation(beforeMs = 7 * 24 * 60 * 60 * 1000) {
+        const allSecrets = await this.storage.listSecrets();
+        const now = Date.now();
+        const threshold = now + beforeMs;
+        return allSecrets.filter(secret => {
+            if (!secret.rotateEvery || !secret.lastRotated)
+                return false;
+            const nextRotation = secret.lastRotated + secret.rotateEvery;
+            return nextRotation <= threshold;
+        });
+    }
+    async getExpiredSecrets() {
+        const allSecrets = await this.storage.listSecrets();
+        return allSecrets.filter(secret => isExpired(secret.expiresAt));
+    }
+    async logAccess(secretId, userId, action) {
+        const accessLog = {
+            id: generateId('access'),
+            secretId,
+            userId,
+            action,
+            timestamp: Date.now(),
+        };
+        await this.storage.logSecretAccess(accessLog);
+    }
+    startRotationCheck(interval, notifyBefore) {
+        this.rotationInterval = setInterval(async () => {
+            const needsRotation = await this.getSecretsNeedingRotation(notifyBefore);
+            if (needsRotation.length > 0) {
+                console.warn(`[SecFn] ${needsRotation.length} secret(s) need rotation:`, needsRotation.map(s => s.key));
+            }
+        }, interval);
+    }
+    stop() {
+        if (this.rotationInterval) {
+            clearInterval(this.rotationInterval);
+        }
+    }
+}
+//# sourceMappingURL=vault.js.map

package/dist/secrets/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/secrets/vault.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAuB5D,MAAM,OAAO,YAAY;IACf,OAAO,CAAmB;IAC1B,UAAU,CAAmB;IAC7B,SAAS,CAAS;IAClB,gBAAgB,CAAkB;IAE1C,YAAY,MAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAE7C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAA4B,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAW;YACrB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC;YACxC,GAAG;YACH,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,GAAG;YAChB,YAAY,EAAE,SAAS;YACvB,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ;YACxC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;QAExE,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAM,GAAG,QAAQ;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAEhD,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAuD;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAEvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,MAAM,GAAG,QAAQ;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/E,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC;QAC9B,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACpB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,MAAM,GAAG,QAAQ;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3C,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,KAAK,GAAG,GAAG;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,WAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACxE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC;QAEjC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YAChC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAE7D,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAC7D,OAAO,YAAY,IAAI,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACpD,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,MAAc,EAAE,MAA8C;QACtG,MAAM,SAAS,GAAiB;YAC9B,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC;YACxB,QAAQ;YACR,MAAM;YACN,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAEO,kBAAkB,CAAC,QAAgB,EAAE,YAAoB;QAC/D,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;YAEzE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,MAAM,2BAA2B,EACrE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,EAAE,QAAQ,CAAC,CAAC;IACf,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;CACF"}

package/dist/storage/indexeddb-storage.d.ts

@@ -0,0 +1,37 @@
+import type { Secret, SecretAccess, Role, UserRole, SecurityEvent, RateLimitEntry, SecretScanResult, EventQuery, SecurityMetrics, TimeRange } from '../types/index.js';
+export declare class IndexedDBStorage {
+    private db;
+    private dbName;
+    constructor(dbName?: string);
+    initialize(): Promise<void>;
+    private getStore;
+    saveSecret(secret: Secret): Promise<void>;
+    getSecret(id: string): Promise<Secret | null>;
+    getSecretByKey(key: string): Promise<Secret | null>;
+    listSecrets(filter?: {
+        environment?: string;
+        tags?: string[];
+    }): Promise<Secret[]>;
+    deleteSecret(id: string): Promise<void>;
+    logSecretAccess(access: SecretAccess): Promise<void>;
+    getSecretAccessLog(secretId: string, limit?: number): Promise<SecretAccess[]>;
+    saveRole(role: Role): Promise<void>;
+    getRole(id: string): Promise<Role | null>;
+    listRoles(): Promise<Role[]>;
+    deleteRole(id: string): Promise<void>;
+    assignUserRole(userRole: UserRole): Promise<void>;
+    getUserRoles(userId: string): Promise<UserRole[]>;
+    removeUserRole(userId: string, roleId: string): Promise<void>;
+    logSecurityEvent(event: SecurityEvent): Promise<void>;
+    queryEvents(query: EventQuery): Promise<SecurityEvent[]>;
+    getMetrics(range: TimeRange): Promise<SecurityMetrics>;
+    getRateLimitEntry(key: string): Promise<RateLimitEntry | null>;
+    setRateLimitEntry(entry: RateLimitEntry): Promise<void>;
+    deleteRateLimitEntry(key: string): Promise<void>;
+    saveScanResult(result: SecretScanResult): Promise<void>;
+    getScanHistory(limit?: number): Promise<SecretScanResult[]>;
+    cleanup(retentionMs: number): Promise<void>;
+    destroy(): Promise<void>;
+    private promisifyRequest;
+}
+//# sourceMappingURL=indexeddb-storage.d.ts.map

package/dist/storage/indexeddb-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexeddb-storage.d.ts","sourceRoot":"","sources":["../../src/storage/indexeddb-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,SAAS,EACV,MAAM,mBAAmB,CAAC;AAe3B,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,EAAE,CAA4B;IACtC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,SAAU;IAItB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAmEjC,OAAO,CAAC,QAAQ;IAMV,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM7C,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAOnD,WAAW,CAAC,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBlF,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAO1E,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAMzC,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAK5B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA+CxD,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC;IAwCtD,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAM9D,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,cAAc,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAMxD,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB3C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAa9B,OAAO,CAAC,gBAAgB;CAMzB"}