@vultisig/client-shared 0.2.16 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @vultisig/client-shared
 
+## 0.3.0
+
+### Minor Changes
+
+- [#1179](https://github.com/vultisig/vultisig-sdk/pull/1179) [`0c80a06`](https://github.com/vultisig/vultisig-sdk/commit/0c80a062bde65c4938a29ce8c1fb6052028615e1) Thanks [@gomesalexandre](https://github.com/gomesalexandre)! - Route the CLI version cache, version output, and VaultStateStore local state through `VULTISIG_CONFIG_DIR` so they stay co-located with SDK vault storage and other shared CLI state.
+
+### Patch Changes
+
+- Updated dependencies [[`69e2fc2`](https://github.com/vultisig/vultisig-sdk/commit/69e2fc2f92c053294b0276440306be5871988be9), [`0c80a06`](https://github.com/vultisig/vultisig-sdk/commit/0c80a062bde65c4938a29ce8c1fb6052028615e1), [`aa47b4a`](https://github.com/vultisig/vultisig-sdk/commit/aa47b4a03c7391d13c738cba68b13a1526d1c502), [`32e5d36`](https://github.com/vultisig/vultisig-sdk/commit/32e5d369ae4723299a6cb8f694da1782dbf207c2)]:
+  - @vultisig/sdk@2.21.1
+
+## 0.2.17
+
+### Patch Changes
+
+- [#878](https://github.com/vultisig/vultisig-sdk/pull/878) [`26dd218`](https://github.com/vultisig/vultisig-sdk/commit/26dd218282b198fdea9c1118e7fe5bc800c071fb) Thanks [@neavra](https://github.com/neavra)! - Harden the vault-registry config store (`config-store.ts`):
+
+  - `loadConfig` now warns to stderr (naming the path and parse error) when
+    `config.json` is corrupted instead of silently reverting to an empty
+    registry, and leaves the bad file intact at load time (the next saveConfig
+    still overwrites it once the user mutates state — this is not durable
+    recovery). A missing file is still treated as the normal first-run case (no
+    warning).
+  - `saveConfig` now writes `config.json` with `0o600` perms (and `chmod`s on
+    every write, since the mode is only honored on create) and creates the
+    config dir with `0o700`, mirroring credential-store's hardening.
+
+- Updated dependencies [[`69bb830`](https://github.com/vultisig/vultisig-sdk/commit/69bb8307de72883f0c7693871a6ca040b7a0756c)]:
+  - @vultisig/sdk@2.8.4
+
 ## 0.2.16
 
 ### Patch Changes

package/dist/config-store.d.ts

@@ -1,3 +1,4 @@
+export declare function getVultisigConfigDir(): string;
 export type VaultEntry = {
     id: string;
     name: string;

package/dist/config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,EAAE,CAAA;CACrB,CAAA;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAOtD;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlE;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAeA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAMD,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,EAAE,CAAA;CACrB,CAAA;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CA4BtD;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBlE;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/config-store.js

@@ -8,21 +8,58 @@ import * as path from 'node:path';
 function getConfigDir() {
     return process.env.VULTISIG_CONFIG_DIR || path.join(os.homedir(), '.vultisig');
 }
+// Public form of the resolver above, for CLI state that must stay co-located
+// with the config store (version cache, vault state). Same call-time contract.
+export function getVultisigConfigDir() {
+    return getConfigDir();
+}
 function getConfigFilePath() {
     return path.join(getConfigDir(), 'config.json');
 }
 export async function loadConfig() {
+    const filePath = getConfigFilePath();
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf-8');
+    }
+    catch (err) {
+        // A missing file is the normal first-run case — stay silent. Any other
+        // read failure (e.g. EACCES) is worth surfacing before falling back.
+        if (err?.code !== 'ENOENT') {
+            console.warn(`[vultisig] Could not read config at ${filePath}: ${err?.message ?? String(err)}. Using an empty registry.`);
+        }
+        return { vaults: [] };
+    }
     try {
-        const raw = await fs.readFile(getConfigFilePath(), 'utf-8');
         return JSON.parse(raw);
     }
-    catch {
+    catch (err) {
+        // Corrupted config (e.g. partial write or single-byte corruption): warn
+        // loudly instead of silently factory-resetting, which would vanish the
+        // user's vault registry. The bad file is left intact AT LOAD TIME (the next
+        // saveConfig still overwrites it when the user mutates state) — this is not
+        // durable recovery, just a chance to inspect the file before the next write.
+        console.warn(`[vultisig] Config at ${filePath} is corrupted (${err?.message ?? String(err)}); using an empty registry. The file was left intact at load time.`);
         return { vaults: [] };
     }
 }
 export async function saveConfig(config) {
-    await fs.mkdir(getConfigDir(), { recursive: true });
-    await fs.writeFile(getConfigFilePath(), JSON.stringify(config, null, 2), 'utf-8');
+    const dir = getConfigDir();
+    const filePath = getConfigFilePath();
+    // 0o700 dir / 0o600 file: the registry maps vault IDs to on-disk vault file
+    // paths and lives alongside credentials. Mirror credential-store's hardening
+    // (commit 7bafd71a).
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.writeFile(filePath, JSON.stringify(config, null, 2), { mode: 0o600 });
+    // writeFile's `mode` is honored only when the file is CREATED; an existing
+    // config.json keeps its old perms. chmod every write so a pre-existing (or
+    // out-of-band) file can't retain looser, world-readable perms.
+    try {
+        await fs.chmod(filePath, 0o600);
+    }
+    catch {
+        /* best-effort: non-POSIX FS (e.g. Windows) ignores perms */
+    }
 }
 export function getConfigPath() {
     return getConfigFilePath();

package/dist/config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,0EAA0E;AAE1E,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,4EAA4E;AAC5E,mFAAmF;AACnF,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAA;AACjD,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAkB;IACjD,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAA;AAC5B,CAAC"}
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,0EAA0E;AAE1E,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,4EAA4E;AAC5E,mFAAmF;AACnF,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAA;AAChF,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAA;AACjD,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,qEAAqE;QACrE,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CACV,uCAAuC,QAAQ,KAAM,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,4BAA4B,CACvH,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,CAAC,IAAI,CACV,wBAAwB,QAAQ,kBAAmB,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,oEAAoE,CAC7J,CAAA;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAkB;IACjD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAA;IAC1B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,4EAA4E;IAC5E,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAA;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { executeAuthLogout, executeAuthSetup, executeAuthStatus } from './auth-setup.js';
-export { getConfigPath, loadConfig, saveConfig, type VaultEntry, type VsigConfig } from './config-store.js';
+export { getConfigPath, getVultisigConfigDir, loadConfig, saveConfig, type VaultEntry, type VsigConfig, } from './config-store.js';
 export { _resetAll, clearCredentials, getCredentialsPath, getDecryptionPassword, getServerPassword, getStoredServerPassword, isUsingFileFallback, setDecryptionPassword, setFilePassphrase, setServerPassword, } from './credential-store.js';
 export * as descriptions from './descriptions.js';
 export { discoverVaultFiles, SEARCH_DIRS } from './vault-discovery.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC3G,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
 export { executeAuthLogout, executeAuthSetup, executeAuthStatus } from './auth-setup.js';
-export { getConfigPath, loadConfig, saveConfig } from './config-store.js';
+export { getConfigPath, getVultisigConfigDir, loadConfig, saveConfig, } from './config-store.js';
 export { _resetAll, clearCredentials, getCredentialsPath, getDecryptionPassword, getServerPassword, getStoredServerPassword, isUsingFileFallback, setDecryptionPassword, setFilePassphrase, setServerPassword, } from './credential-store.js';
 export * as descriptions from './descriptions.js';
 export { discoverVaultFiles, SEARCH_DIRS } from './vault-discovery.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAoC,MAAM,mBAAmB,CAAA;AAC3G,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,UAAU,GAGX,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/client-shared",
-  "version": "0.2.16",
+  "version": "0.3.0",
   "description": "Shared client infrastructure for Vultisig CLI and MCP — auth, config, tool descriptions",
   "license": "MIT",
   "repository": {
@@ -31,11 +31,11 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^1.3.0",
-    "@vultisig/sdk": "^2.7.0",
+    "@vultisig/sdk": "^2.21.1",
     "inquirer": "^14.0.2"
   },
   "devDependencies": {
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.1.1",
     "typescript": "^6.0.3"
   },
   "publishConfig": {