@stitchaxis/latchkey 0.0.0-stage → 0.1.0

package/dist/vault.js

@@ -0,0 +1,171 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { CONFIG_FILE, LATCHKEY_DIR, VAULT_FILE, } from "./paths.js";
+import { decryptSecret, encryptSecret, initSodium, } from "./crypto.js";
+import { generateMasterKey, storeMasterKeyInKeychain, storePassphraseWrap, tryGetMasterKeyFromKeychain, unlockWithPassphrase, hasPassphraseWrap, } from "./keychain.js";
+import { getCachedMasterKey, setCachedMasterKey, touchActivity, lockVault, isLocked, } from "./lock.js";
+import { auditLog } from "./audit.js";
+import { isKeyAllowed, loadProjectScope } from "./scope.js";
+import { getEffectiveAccess } from "./licensing/access.js";
+import { enforceBeforeSecretAccess, enforceBeforeVaultWrite, } from "./licensing/enforce.js";
+async function readConfig() {
+    if (!existsSync(CONFIG_FILE))
+        return {};
+    const raw = await readFile(CONFIG_FILE, "utf8");
+    return JSON.parse(raw);
+}
+async function writeConfig(config) {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), "utf8");
+}
+export async function ensureVaultInitialized(options) {
+    await initSodium();
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    await getEffectiveAccess();
+    if (!existsSync(VAULT_FILE)) {
+        await enforceBeforeVaultWrite();
+        const masterKey = generateMasterKey();
+        if (options?.passphrase || options?.preferPassphrase) {
+            if (!options.passphrase) {
+                throw new Error("Passphrase required for passphrase-backed vault");
+            }
+            await storePassphraseWrap(masterKey, options.passphrase);
+        }
+        else {
+            await storeMasterKeyInKeychain(masterKey);
+        }
+        const doc = { version: 1, secrets: [] };
+        await writeFile(VAULT_FILE, JSON.stringify(doc, null, 2), "utf8");
+        await auditLog({ action: "vault_init" });
+    }
+    const config = await readConfig();
+    if (config.idleLockMinutes) {
+        const { configureIdleLock } = await import("./lock.js");
+        configureIdleLock(config.idleLockMinutes * 60 * 1000);
+    }
+}
+export async function unlockVault(passphrase) {
+    await initSodium();
+    const cached = getCachedMasterKey();
+    if (cached) {
+        touchActivity();
+        return cached;
+    }
+    let masterKey = await tryGetMasterKeyFromKeychain();
+    if (!masterKey && (await hasPassphraseWrap())) {
+        if (!passphrase) {
+            throw new Error("Vault is locked. Provide LATCHKEY_PASSPHRASE or run latchkey unlock (passphrase fallback).");
+        }
+        masterKey = await unlockWithPassphrase(passphrase);
+    }
+    if (!masterKey) {
+        throw new Error("No master key in OS keychain and no passphrase wrap found. Run latchkey init.");
+    }
+    setCachedMasterKey(masterKey);
+    await auditLog({ action: "unlock" });
+    return masterKey;
+}
+export async function loadVaultDoc() {
+    if (!existsSync(VAULT_FILE)) {
+        throw new Error("Vault not initialized. Run: latchkey init");
+    }
+    const raw = await readFile(VAULT_FILE, "utf8");
+    return JSON.parse(raw);
+}
+async function saveVaultDoc(doc) {
+    await writeFile(VAULT_FILE, JSON.stringify(doc, null, 2), "utf8");
+}
+export async function addSecret(name, value, passphrase) {
+    await getEffectiveAccess();
+    const masterKey = await unlockVault(passphrase);
+    const doc = await loadVaultDoc();
+    const now = new Date().toISOString();
+    const { ciphertext, nonce } = encryptSecret(value, masterKey);
+    const existing = doc.secrets.findIndex((s) => s.name === name);
+    const entry = {
+        name,
+        ciphertext,
+        nonce,
+        createdAt: existing >= 0 ? doc.secrets[existing].createdAt : now,
+        updatedAt: now,
+    };
+    if (existing >= 0) {
+        doc.secrets[existing] = entry;
+    }
+    else {
+        doc.secrets.push(entry);
+    }
+    await saveVaultDoc(doc);
+    touchActivity();
+    await auditLog({ action: "secret_add", key: name });
+}
+export async function getSecret(name, options) {
+    const cwd = options?.cwd ?? process.cwd();
+    await enforceBeforeSecretAccess(cwd);
+    const masterKey = await unlockVault(options?.passphrase);
+    const scope = options?.enforceScope !== false
+        ? await loadProjectScope(options?.cwd ?? process.cwd())
+        : null;
+    if (options?.enforceScope !== false && !isKeyAllowed(scope, name)) {
+        await auditLog({
+            action: "scope_denied",
+            key: name,
+            project: scope?.projectRoot,
+        });
+        throw new Error(`Key "${name}" is not allowed by ${scope ? ".latchkey.toml" : "scope policy"}`);
+    }
+    const doc = await loadVaultDoc();
+    const entry = doc.secrets.find((s) => s.name === name);
+    if (!entry) {
+        throw new Error(`Unknown secret: ${name}`);
+    }
+    const value = decryptSecret(entry.ciphertext, entry.nonce, masterKey);
+    touchActivity();
+    await auditLog({
+        action: "secret_get",
+        key: name,
+        project: scope?.projectRoot,
+    });
+    return value;
+}
+export async function listSecrets(passphrase) {
+    await getEffectiveAccess();
+    await unlockVault(passphrase);
+    const doc = await loadVaultDoc();
+    touchActivity();
+    await auditLog({ action: "secret_list" });
+    return doc.secrets.map((s) => s.name).sort();
+}
+export async function removeSecret(name, passphrase) {
+    await unlockVault(passphrase);
+    const doc = await loadVaultDoc();
+    const next = doc.secrets.filter((s) => s.name !== name);
+    if (next.length === doc.secrets.length) {
+        throw new Error(`Unknown secret: ${name}`);
+    }
+    doc.secrets = next;
+    await saveVaultDoc(doc);
+    touchActivity();
+    await auditLog({ action: "secret_remove", key: name });
+}
+export async function buildEnvForRun(keyNames, options) {
+    const env = {};
+    for (const name of keyNames) {
+        env[name] = await getSecret(name, {
+            passphrase: options?.passphrase,
+            cwd: options?.cwd,
+            enforceScope: true,
+        });
+    }
+    await auditLog({
+        action: "run_inject",
+        command: keyNames.join(","),
+        project: options?.cwd,
+    });
+    return env;
+}
+export function lock() {
+    lockVault();
+    void auditLog({ action: "lock" });
+}
+export { isLocked };

package/dist/vault.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/vault.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+describe("vault", () => {
+    let prevHome;
+    let tempHome;
+    beforeEach(async () => {
+        prevHome = process.env.LATCHKEY_HOME;
+        tempHome = await mkdtemp(join(tmpdir(), "latchkey-test-"));
+        process.env.LATCHKEY_HOME = tempHome;
+    });
+    afterEach(async () => {
+        process.env.LATCHKEY_HOME = prevHome;
+        await rm(tempHome, { recursive: true, force: true });
+    });
+    it("stores and retrieves secrets with passphrase wrap", async () => {
+        const { ensureVaultInitialized, addSecret, getSecret, listSecrets } = await import("./vault.js");
+        await ensureVaultInitialized({
+            passphrase: "test-passphrase-123",
+            preferPassphrase: true,
+        });
+        await addSecret("OPENAI_API_KEY", "sk-test-value", "test-passphrase-123");
+        const names = await listSecrets("test-passphrase-123");
+        expect(names).toContain("OPENAI_API_KEY");
+        const value = await getSecret("OPENAI_API_KEY", {
+            passphrase: "test-passphrase-123",
+            enforceScope: false,
+        });
+        expect(value).toBe("sk-test-value");
+    }, 20000);
+});

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "@stitchaxis/latchkey",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Local-first encrypted vault for AI API keys",
+  "type": "module",
+  "bin": {
+    "latchkey": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node ../../node_modules/typescript/bin/tsc",
+    "test": "node ../../node_modules/vitest/vitest.mjs run",
+    "test:watch": "node ../../node_modules/vitest/vitest.mjs",
+    "daemon": "node dist/daemon.js",
+    "mcp": "node dist/mcp-server.js",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@stitchaxis/license": "0.1.0",
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "commander": "^13.1.0",
+    "keytar": "^7.9.0",
+    "libsodium-wrappers-sumo": "^0.8.4",
+    "toml": "^3.0.0",
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "@types/libsodium-wrappers": "^0.7.14",
+    "@types/node": "^22.13.10",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.9"
+  }
+}