@vibesdotdev/config 0.0.1

package/src/services/config-storage/service.ts

@@ -0,0 +1,355 @@
+/**
+ * Config Storage Service
+ *
+ * Unified configuration storage using runtime-resolved storage adapter.
+ * Provides credentials and config document CRUD through SqlDatabaseHandle.
+ */
+
+import { randomUUID } from 'crypto';
+import { join } from 'path';
+
+interface SqlStatement<T, P extends unknown[] = unknown[]> {
+	all(...params: P): T[];
+	get(...params: P): T | undefined;
+	run(...params: P): void;
+}
+
+interface SqlDatabaseHandle {
+	exec(sql: string): void;
+	query<T, P extends unknown[] = unknown[]>(sql: string): SqlStatement<T, P>;
+}
+
+const CONFIG_DB_PATH = join('.vibes', 'config.db');
+const CONFIG_NAMESPACE = 'config';
+
+export type ConfigScope = 'global' | 'local' | 'project';
+
+export interface CredentialsInput {
+	environment: string;
+	apiKey?: string;
+	sessionToken?: string;
+	refreshToken?: string;
+	userId?: string;
+	email?: string;
+	name?: string;
+	expiresAt?: string;
+	metadata?: Record<string, unknown>;
+}
+
+export interface ConfigDocumentInput {
+	scope: ConfigScope;
+	content: Record<string, unknown>;
+	namespace?: string;
+	encrypted?: boolean;
+	changeReason?: string;
+}
+
+interface CredentialsRow {
+	id: string;
+	environment: string;
+	api_key: string | null;
+	session_token: string | null;
+	refresh_token: string | null;
+	user_id: string | null;
+	email: string | null;
+	name: string | null;
+	expires_at: string | null;
+	metadata: string | null;
+	created_at: string;
+	updated_at: string;
+}
+
+interface ConfigDocumentRow {
+	id: string;
+	scope: ConfigScope;
+	namespace: string | null;
+	content: string;
+	version: number;
+	encrypted: number;
+	created_at: string;
+	updated_at: string;
+}
+
+type StorageAdapter = {
+	getDatabaseConnection: () => unknown;
+	ensureReady: () => Promise<void>;
+};
+
+type Runtime = {
+	query: (kind: string) => {
+		withId: (id: string) => {
+			resolve: () => Promise<StorageAdapter>;
+		};
+	};
+};
+
+async function createStorageAdapter(runtime: Runtime): Promise<StorageAdapter> {
+	const adapter = await runtime.query('storage/adapter').withId(CONFIG_NAMESPACE).resolve();
+	await adapter.ensureReady();
+	return adapter;
+}
+
+function getSqlHandle(adapter: StorageAdapter): SqlDatabaseHandle {
+	return adapter.getDatabaseConnection() as SqlDatabaseHandle;
+}
+
+function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown> {
+	const result = { ...target };
+	for (const key of Object.keys(source)) {
+		const sourceValue = source[key];
+		const targetValue = result[key];
+		if (
+			sourceValue !== null &&
+			typeof sourceValue === 'object' &&
+			!Array.isArray(sourceValue) &&
+			targetValue !== null &&
+			typeof targetValue === 'object' &&
+			!Array.isArray(targetValue)
+		) {
+			result[key] = deepMerge(targetValue as Record<string, unknown>, sourceValue as Record<string, unknown>);
+		} else {
+			result[key] = sourceValue;
+		}
+	}
+	return result;
+}
+
+export class ConfigStorageService {
+	private sql: SqlDatabaseHandle | null = null;
+	private initPromise: Promise<void> | null = null;
+	private runtime: Runtime;
+
+	constructor(runtime: Runtime) {
+		this.runtime = runtime;
+	}
+
+	private async ensureInitialized(): Promise<SqlDatabaseHandle> {
+		if (this.sql) return this.sql;
+		if (!this.initPromise) {
+			this.initPromise = (async () => {
+				const adapter = await createStorageAdapter(this.runtime);
+				this.sql = getSqlHandle(adapter);
+				this.createTables();
+			})();
+		}
+		await this.initPromise;
+		return this.sql!;
+	}
+
+	private createTables(): void {
+		if (!this.sql) return;
+		this.sql.exec(`
+			CREATE TABLE IF NOT EXISTS credentials (
+				id TEXT PRIMARY KEY,
+				environment TEXT NOT NULL UNIQUE,
+				api_key TEXT,
+				session_token TEXT,
+				refresh_token TEXT,
+				user_id TEXT,
+				email TEXT,
+				name TEXT,
+				expires_at TEXT,
+				metadata TEXT,
+				created_at TEXT NOT NULL DEFAULT (datetime('now')),
+				updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+			);
+			CREATE INDEX IF NOT EXISTS idx_credentials_environment ON credentials(environment);
+
+			CREATE TABLE IF NOT EXISTS config_documents (
+				id TEXT PRIMARY KEY,
+				scope TEXT NOT NULL CHECK(scope IN ('global', 'local', 'project')),
+				namespace TEXT,
+				content TEXT NOT NULL DEFAULT '{}',
+				version INTEGER NOT NULL DEFAULT 1,
+				encrypted INTEGER NOT NULL DEFAULT 0,
+				created_at TEXT NOT NULL DEFAULT (datetime('now')),
+				updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+				UNIQUE(scope, namespace)
+			);
+			CREATE INDEX IF NOT EXISTS idx_config_documents_scope ON config_documents(scope);
+			CREATE INDEX IF NOT EXISTS idx_config_documents_namespace ON config_documents(namespace);
+		`);
+	}
+
+	async getCredentials(environment: string): Promise<CredentialsInput | null> {
+		const sql = await this.ensureInitialized();
+		const row = sql.query<CredentialsRow, [string]>('SELECT * FROM credentials WHERE environment = ?').get(environment);
+		if (!row) return null;
+		return {
+			environment: row.environment,
+			apiKey: row.api_key ?? undefined,
+			sessionToken: row.session_token ?? undefined,
+			refreshToken: row.refresh_token ?? undefined,
+			userId: row.user_id ?? undefined,
+			email: row.email ?? undefined,
+			name: row.name ?? undefined,
+			expiresAt: row.expires_at ?? undefined,
+			metadata: row.metadata ? JSON.parse(row.metadata) : undefined
+		};
+	}
+
+	async setCredentials(input: CredentialsInput): Promise<void> {
+		const sql = await this.ensureInitialized();
+		const now = new Date().toISOString();
+		const existing = sql.query<{ id: string }, [string]>('SELECT id FROM credentials WHERE environment = ?').get(input.environment);
+		if (existing) {
+			sql.query(
+				`UPDATE credentials SET
+					api_key = ?, session_token = ?, refresh_token = ?,
+					user_id = ?, email = ?, name = ?, expires_at = ?,
+					metadata = ?, updated_at = ?
+					WHERE environment = ?`
+			).run(
+				input.apiKey ?? null,
+				input.sessionToken ?? null,
+				input.refreshToken ?? null,
+				input.userId ?? null,
+				input.email ?? null,
+				input.name ?? null,
+				input.expiresAt ?? null,
+				input.metadata ? JSON.stringify(input.metadata) : null,
+				now,
+				input.environment
+			);
+		} else {
+			sql.query(
+				`INSERT INTO credentials
+					(id, environment, api_key, session_token, refresh_token,
+					 user_id, email, name, expires_at, metadata, created_at, updated_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			).run(
+				randomUUID(),
+				input.environment,
+				input.apiKey ?? null,
+				input.sessionToken ?? null,
+				input.refreshToken ?? null,
+				input.userId ?? null,
+				input.email ?? null,
+				input.name ?? null,
+				input.expiresAt ?? null,
+				input.metadata ? JSON.stringify(input.metadata) : null,
+				now,
+				now
+			);
+		}
+	}
+
+	async deleteCredentials(environment: string): Promise<void> {
+		const sql = await this.ensureInitialized();
+		sql.query('DELETE FROM credentials WHERE environment = ?').run(environment);
+	}
+
+	async getDocument<T = Record<string, unknown>>(scope: ConfigScope, namespace: string | null = null): Promise<T | null> {
+		const sql = await this.ensureInitialized();
+		let row: ConfigDocumentRow | null;
+		if (namespace === null) {
+			row = sql.query<ConfigDocumentRow, [string]>('SELECT * FROM config_documents WHERE scope = ? AND namespace IS NULL').get(scope) ?? null;
+		} else {
+			row = sql.query<ConfigDocumentRow, [string, string]>('SELECT * FROM config_documents WHERE scope = ? AND namespace = ?').get(scope, namespace) ?? null;
+		}
+		if (!row) return null;
+		try {
+			return JSON.parse(row.content) as T;
+		} catch {
+			return null;
+		}
+	}
+
+	async getDocumentMerged<T = Record<string, unknown>>(
+		scopes: ConfigScope[],
+		namespace: string | null = null
+	): Promise<{ config: T; sources: Array<{ scope: ConfigScope; version: number }> }> {
+		const sql = await this.ensureInitialized();
+		let merged: Record<string, unknown> = {};
+		const sources: Array<{ scope: ConfigScope; version: number }> = [];
+		for (const scope of scopes) {
+			let row: ConfigDocumentRow | null;
+			if (namespace === null) {
+				row = sql.query<ConfigDocumentRow, [string]>('SELECT * FROM config_documents WHERE scope = ? AND namespace IS NULL').get(scope) ?? null;
+			} else {
+				row = sql.query<ConfigDocumentRow, [string, string]>('SELECT * FROM config_documents WHERE scope = ? AND namespace = ?').get(scope, namespace) ?? null;
+			}
+			if (row) {
+				try {
+					const content = JSON.parse(row.content);
+					merged = deepMerge(merged, content);
+					sources.push({ scope, version: row.version });
+				} catch {
+					// Skip malformed content
+				}
+			}
+		}
+		return { config: merged as T, sources };
+	}
+
+	async setDocument(input: ConfigDocumentInput): Promise<void> {
+		const sql = await this.ensureInitialized();
+		const now = new Date().toISOString();
+		const namespace = input.namespace ?? null;
+		let existing: ConfigDocumentRow | null;
+		if (namespace === null) {
+			existing = sql.query<ConfigDocumentRow, [string]>('SELECT * FROM config_documents WHERE scope = ? AND namespace IS NULL').get(input.scope) ?? null;
+		} else {
+			existing = sql.query<ConfigDocumentRow, [string, string]>('SELECT * FROM config_documents WHERE scope = ? AND namespace = ?').get(input.scope, namespace) ?? null;
+		}
+		const content = JSON.stringify(input.content);
+		const encrypted = input.encrypted ? 1 : 0;
+		if (existing) {
+			sql.query(
+				`UPDATE config_documents SET
+					content = ?, version = version + 1, encrypted = ?, updated_at = ?
+					WHERE id = ?`
+			).run(content, encrypted, now, existing.id);
+		} else {
+			sql.query(
+				`INSERT INTO config_documents
+					(id, scope, namespace, content, version, encrypted, created_at, updated_at)
+					VALUES (?, ?, ?, ?, 1, ?, ?, ?)`
+			).run(randomUUID(), input.scope, namespace, content, encrypted, now, now);
+		}
+	}
+
+	async mergeDocument(
+		scope: ConfigScope,
+		content: Record<string, unknown>,
+		namespace: string | null = null,
+		changeReason?: string
+	): Promise<void> {
+		const existing = await this.getDocument<Record<string, unknown>>(scope, namespace);
+		const merged = deepMerge(existing || {}, content);
+		await this.setDocument({
+			scope,
+			namespace: namespace ?? undefined,
+			content: merged,
+			encrypted: false,
+			changeReason
+		});
+	}
+
+	async deleteDocument(scope: ConfigScope, namespace: string | null = null): Promise<void> {
+		const sql = await this.ensureInitialized();
+		if (namespace === null) {
+			sql.query('DELETE FROM config_documents WHERE scope = ? AND namespace IS NULL').run(scope);
+		} else {
+			sql.query('DELETE FROM config_documents WHERE scope = ? AND namespace = ?').run(scope, namespace);
+		}
+	}
+
+	async close(): Promise<void> {
+		this.sql = null;
+		this.initPromise = null;
+	}
+}
+
+let instance: ConfigStorageService | null = null;
+
+export function getConfigStorageService(runtime: Runtime): ConfigStorageService {
+	if (!instance) {
+		instance = new ConfigStorageService(runtime);
+	}
+	return instance;
+}
+
+export function resetConfigStorageService(): void {
+	instance = null;
+}

package/src/services/config.ts

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+
+const VIBES_CONFIG_DIR = join(homedir(), '.config', 'vibes');
+const GLOBAL_CONFIG_FILE = join(VIBES_CONFIG_DIR, 'config.json');
+
+function ensureConfigDir(): void {
+	if (!existsSync(VIBES_CONFIG_DIR)) {
+		mkdirSync(VIBES_CONFIG_DIR, { recursive: true });
+	}
+}
+
+export async function loadConfigForScope(
+	scope: 'global' | 'project'
+): Promise<Record<string, unknown>> {
+	ensureConfigDir();
+	if (scope === 'global' && existsSync(GLOBAL_CONFIG_FILE)) {
+		try {
+			const content = readFileSync(GLOBAL_CONFIG_FILE, 'utf-8');
+			return JSON.parse(content) as Record<string, unknown>;
+		} catch {
+			return {};
+		}
+	}
+	return {};
+}
+
+export async function saveConfigForScope(
+	config: Record<string, unknown>,
+	scope: 'global' | 'project'
+): Promise<void> {
+	ensureConfigDir();
+	if (scope === 'global') {
+		writeFileSync(GLOBAL_CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8');
+	}
+}

package/src/services/encryption.ts

@@ -0,0 +1,260 @@
+/**
+ * Config Encryption Service
+ *
+ * Production-grade encryption for sensitive configuration values.
+ * Uses AES-256-GCM for authenticated encryption with PBKDF2 key derivation.
+ *
+ * Features:
+ * - AES-256-GCM authenticated encryption
+ * - PBKDF2 key derivation (100k iterations)
+ * - Random IV and salt generation
+ * - Constant-time comparison helpers
+ * - Browser and Node.js compatible (Web Crypto API)
+ */
+
+import { createHash, randomBytes, createCipheriv, createDecipheriv, pbkdf2Sync } from 'crypto';
+
+// Algorithm constants
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16; // 128 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+const SALT_LENGTH = 32; // 256 bits
+const KEY_LENGTH = 32; // 256 bits
+const PBKDF2_ITERATIONS = 100_000;
+
+import type { EncryptedValue, SerializedEncryptedValue, EncryptionOptions } from './schemas/encryption.schema.ts';
+
+export type { EncryptedValue, SerializedEncryptedValue, EncryptionOptions } from './schemas/encryption.schema.ts';
+
+/**
+ * Derive a 256-bit key from password and salt using PBKDF2.
+ *
+ * @param password - The encryption password/key
+ * @param salt - Random salt for key derivation
+ * @returns 32-byte derived key
+ */
+function deriveKey(password: string, salt: Buffer): Buffer {
+	return pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha256');
+}
+
+/**
+ * Encrypt a string value using AES-256-GCM.
+ *
+ * @param value - The plaintext value to encrypt
+ * @param password - The encryption password/key
+ * @param options - Optional encryption parameters
+ * @returns EncryptedValue with all components needed for decryption
+ * @throws Error if encryption fails
+ *
+ * @example
+ * ```typescript
+ * const encrypted = await encrypt('my-secret-api-key', 'my-master-password');
+ * // Store encrypted object
+ * ```
+ */
+export async function encrypt(
+	value: string,
+	password: string,
+	options: EncryptionOptions = {}
+): Promise<EncryptedValue> {
+	if (!value) {
+		throw new Error('Cannot encrypt empty value');
+	}
+	if (!password) {
+		throw new Error('Encryption password is required');
+	}
+
+	// Generate random salt and IV
+	const salt = options.salt ?? randomBytes(SALT_LENGTH);
+	const iv = options.iv ?? randomBytes(IV_LENGTH);
+
+	// Derive key from password
+	const key = deriveKey(password, salt);
+
+	// Encrypt
+	const cipher = createCipheriv(ALGORITHM, key, iv);
+	let encrypted = cipher.update(value, 'utf8', 'base64');
+	encrypted += cipher.final('base64');
+	const tag = cipher.getAuthTag();
+
+	return {
+		ciphertext: encrypted,
+		iv: iv.toString('base64'),
+		salt: salt.toString('base64'),
+		tag: tag.toString('base64'),
+		algorithm: ALGORITHM,
+		iterations: PBKDF2_ITERATIONS
+	};
+}
+
+/**
+ * Decrypt an encrypted value using AES-256-GCM.
+ *
+ * @param encrypted - The encrypted value object
+ * @param password - The encryption password/key
+ * @returns The decrypted plaintext value
+ * @throws Error if decryption fails (wrong password, corrupted data, etc.)
+ *
+ * @example
+ * ```typescript
+ * const encrypted = {
+ *   ciphertext: '...',
+ *   iv: '...',
+ *   salt: '...',
+ *   tag: '...',
+ *   algorithm: 'aes-256-gcm',
+ *   iterations: 100000
+ * };
+ * const decrypted = await decrypt(encrypted, 'my-master-password');
+ * ```
+ */
+export async function decrypt(encrypted: EncryptedValue, password: string): Promise<string> {
+	if (!password) {
+		throw new Error('Decryption password is required');
+	}
+
+	// Validate algorithm
+	if (encrypted.algorithm !== ALGORITHM) {
+		throw new Error(`Unsupported algorithm: ${encrypted.algorithm}`);
+	}
+
+	// Decode components
+	const salt = Buffer.from(encrypted.salt, 'base64');
+	const iv = Buffer.from(encrypted.iv, 'base64');
+	const tag = Buffer.from(encrypted.tag, 'base64');
+
+	// Derive key
+	const key = deriveKey(password, salt);
+
+	// Decrypt
+	try {
+		const decipher = createDecipheriv(ALGORITHM, key, iv);
+		decipher.setAuthTag(tag);
+		let decrypted = decipher.update(encrypted.ciphertext, 'base64', 'utf8');
+		decrypted += decipher.final('utf8');
+		return decrypted;
+	} catch (error) {
+		throw new Error('Decryption failed: invalid password or corrupted data');
+	}
+}
+
+/**
+ * Serialize an encrypted value to a compact JSON object for storage.
+ *
+ * @param encrypted - The encrypted value
+ * @returns Compact serialized format
+ */
+export function serializeEncrypted(encrypted: EncryptedValue): SerializedEncryptedValue {
+	return {
+		v: 1,
+		ct: encrypted.ciphertext,
+		iv: encrypted.iv,
+		s: encrypted.salt,
+		t: encrypted.tag,
+		a: encrypted.algorithm,
+		i: encrypted.iterations
+	};
+}
+
+/**
+ * Deserialize a compact JSON object back to EncryptedValue format.
+ *
+ * @param serialized - The serialized encrypted value
+ * @returns EncryptedValue object
+ */
+export function deserializeEncrypted(serialized: SerializedEncryptedValue): EncryptedValue {
+	return {
+		ciphertext: serialized.ct,
+		iv: serialized.iv,
+		salt: serialized.s,
+		tag: serialized.t,
+		algorithm: serialized.a,
+		iterations: serialized.i
+	};
+}
+
+/**
+ * Encrypt a value and serialize it to a JSON string for storage.
+ *
+ * @param value - The plaintext value
+ * @param password - The encryption password
+ * @returns JSON string of serialized encrypted value
+ */
+export async function encryptToString(value: string, password: string): Promise<string> {
+	const encrypted = await encrypt(value, password);
+	const serialized = serializeEncrypted(encrypted);
+	return JSON.stringify(serialized);
+}
+
+/**
+ * Decrypt a value from its serialized JSON string format.
+ *
+ * @param encryptedString - JSON string from encryptToString
+ * @param password - The encryption password
+ * @returns The decrypted plaintext value
+ */
+export async function decryptFromString(encryptedString: string, password: string): Promise<string> {
+	const serialized = JSON.parse(encryptedString) as SerializedEncryptedValue;
+	const encrypted = deserializeEncrypted(serialized);
+	return decrypt(encrypted, password);
+}
+
+/**
+ * Generate a secure random password of the specified length.
+ *
+ * @param length - Password length (default: 32)
+ * @returns Base64-encoded random string
+ */
+export function generateSecurePassword(length = 32): string {
+	return randomBytes(length).toString('base64').slice(0, length);
+}
+
+/**
+ * Hash a password for storage using SHA-256.
+ * This is NOT for encryption keys - use only for password verification.
+ *
+ * @param password - The password to hash
+ * @returns SHA-256 hash as hex string
+ */
+export function hashPassword(password: string): string {
+	return createHash('sha256').update(password).digest('hex');
+}
+
+/**
+ * Verify a password against a stored hash.
+ *
+ * @param password - The password to verify
+ * @param hash - The stored hash
+ * @returns True if the password matches
+ */
+export function verifyPassword(password: string, hash: string): boolean {
+	// Constant-time comparison to prevent timing attacks
+	const computed = hashPassword(password);
+	if (computed.length !== hash.length) return false;
+
+	let result = 0;
+	for (let i = 0; i < computed.length; i++) {
+		result |= computed.charCodeAt(i) ^ hash.charCodeAt(i);
+	}
+	return result === 0;
+}
+
+/**
+ * Check if a value appears to be an encrypted value.
+ *
+ * @param value - The value to check
+ * @returns True if the value looks like an encrypted config value
+ */
+export function isEncryptedValue(value: unknown): value is SerializedEncryptedValue {
+	if (typeof value !== 'object' || value === null) return false;
+	const v = value as SerializedEncryptedValue;
+	return (
+		v.v === 1 &&
+		typeof v.ct === 'string' &&
+		typeof v.iv === 'string' &&
+		typeof v.s === 'string' &&
+		typeof v.t === 'string' &&
+		typeof v.a === 'string' &&
+		typeof v.i === 'number'
+	);
+}

package/src/services/index.ts

@@ -0,0 +1,34 @@
+/**
+ * Config Services
+ *
+ * Higher-level services built on top of the config infrastructure.
+ */
+
+// Runtime-scoped config loader (replaces unified-loader.ts)
+//
+// IMPORTANT: do not re-export the consumer/cloud/local-first loader impls here.
+// They are runtime-scoped and loaded lazily via dynamic import() in
+// config.plugin.ts. Re-exporting them statically would let bundlers
+// (e.g. workerd/cloudflare) walk the barrel and pull consumer-only code
+// (localdb adapter) into worker bundles where it cannot resolve.
+export {
+	configLoaderDescriptor
+} from './loader/loader.descriptor.ts';
+export type { ConfigLoaderInterface, LoadResult, SaveResult } from './loader/loader.descriptor.ts';
+
+export { createConfigAccessor, createSyncConfigAccessor } from './config-accessor.ts';
+export type { ConfigAccessor, ConfigAccessorInterface } from './config-accessor.ts';
+
+export {
+	encrypt,
+	decrypt,
+	serializeEncrypted,
+	deserializeEncrypted,
+	encryptToString,
+	decryptFromString,
+	generateSecurePassword,
+	hashPassword,
+	verifyPassword,
+	isEncryptedValue
+} from './encryption.ts';
+export type { EncryptedValue, SerializedEncryptedValue, EncryptionOptions } from './encryption.ts';