@vapi-network/core 0.2.3 → 0.5.0

package/dist/secret-store.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The OS secret store, so an agent never needs a passphrase in plain text.
+ *
+ * A wallet's passphrase is kept by the operating system's own credential
+ * store — the macOS Keychain, or libsecret on Linux — under the service
+ * `vapi-network` and the wallet's name as the account. `vapi unlock` puts it
+ * there, `vapi lock` takes it out, and every unlock path reads it from there
+ * before falling back to a prompt.
+ *
+ * There is no dependency: the store is driven through the OS binaries with
+ * `execFile` and an argument array, never a shell string, so nothing a wallet
+ * name or a passphrase contains can be read as a command. The passphrase
+ * itself is written to the binary's stdin and never appears in an argument,
+ * where `ps` would show it to every process on the machine.
+ */
+/** The service name every vAPI entry is filed under. */
+export declare const SECRET_STORE_SERVICE = "vapi-network";
+/** What one run of an OS binary produced. A runner never throws for a non-zero exit. */
+export type SecretStoreOutcome = {
+    /** The exit code, or null when the binary could not be run at all. */
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    /** The binary is not installed on this machine. */
+    notFound?: boolean;
+};
+/**
+ * Runs one OS binary. Injected by the tests, which assert the command line
+ * rather than touching a real keychain.
+ */
+export type SecretStoreRunner = (file: string, args: readonly string[], input?: string) => Promise<SecretStoreOutcome>;
+export type SecretStore = {
+    /** Whether this platform has a store vAPI can drive at all. */
+    available: boolean;
+    platform: NodeJS.Platform;
+    /** How to name this store to a person, such as "the macOS Keychain". */
+    description: string;
+    /** The stored passphrase of a wallet, or undefined when there is none. */
+    get(name: string): Promise<string | undefined>;
+    /** Whether a wallet has a stored passphrase, without reading the secret. */
+    has(name: string): Promise<boolean>;
+    set(name: string, passphrase: string): Promise<void>;
+    /** Removes the entry; false when there was nothing to remove. */
+    remove(name: string): Promise<boolean>;
+    /**
+     * The wallet names this store holds, where the platform can answer it
+     * without handing back the secrets themselves. Neither platform can today,
+     * so callers list the wallets they know and ask `has` about each.
+     */
+    list?(): Promise<string[]>;
+};
+export type SecretStoreOptions = {
+    /** Defaults to `process.platform`. */
+    platform?: NodeJS.Platform | undefined;
+    /** Defaults to running the real binary. */
+    run?: SecretStoreRunner | undefined;
+};
+/** The secret store of this machine, or one that refuses on every call. */
+export declare function secretStore(options?: SecretStoreOptions): SecretStore;
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AAEH,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAgBnD,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC,MAAM,MAAM,WAAW,GAAG;IACxB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,4EAA4E;IAC5E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC;;;;OAIG;IACH,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IACvC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAMzE"}

package/dist/secrets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `@vapi-network/core/secrets` — the human-only corner of the SDK.
+ *
+ * Everything here returns a recovery phrase or a private key. It is a separate
+ * package entry point, and deliberately not re-exported from the main index,
+ * so that a package which must never hold a secret — the MCP server above all —
+ * cannot reach one by importing `@vapi-network/core`. The repository lint rules
+ * enforce that for `packages/mcp`.
+ *
+ * Callers must print the result to the person in front of the terminal and
+ * nowhere else: not to a log, not to a file, not into a tool result.
+ */
+export { createKeystoreWithPhrase, decryptPrivateKey, exportKeystoreKeys, exportRecoveryPhrase, type ExportedVapiKeys, } from "./keystore.js";
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC"}