@wrongstack/core 0.260.0 → 0.265.1

package/dist/{secret-vault-CDvDYXWX.d.ts → secret-vault-B2yw84VT.d.ts}

@@ -1,6 +1,6 @@
-import { S as SecretScrubber } from './permission-BJ7eO9Vl.js';
+import { S as SecretScrubber } from './permission-B9SB45lp.js';
 import { L as Logger } from './logger-B63L5bTg.js';
-import { S as SecretVault } from './secret-vault-BJDY28ev.js';
+import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 
 declare class DefaultSecretScrubber implements SecretScrubber {
     scrub(text: string): string;
@@ -24,14 +24,33 @@ interface SecretVaultOptions {
  * The key is loaded lazily on first encrypt/decrypt; if it does not exist,
  * a fresh one is generated. Decryption of plaintext values is a no-op so
  * legacy configs continue to work.
+ *
+ * Key file format:
+ *   - Legacy (v1): exactly 32 raw bytes
+ *   - Versioned (v2+): 4-byte magic `WSKV` + 1-byte version + 32-byte key (37 bytes)
+ *
+ * Encrypted value format: `enc:v<N>:<iv>:<tag>:<ciphertext>` where N is the
+ * key version. After rotation, encrypt() emits the new version prefix.
  */
-declare class DefaultSecretVault implements SecretVault {
+declare class DefaultSecretVault implements RotatableSecretVault {
     private readonly keyFile;
     private key?;
+    private _keyVersion;
     constructor(opts: SecretVaultOptions);
+    /** Current key version. Starts at 1; incremented by rotateKey(). */
+    get keyVersion(): number;
     isEncrypted(value: string): boolean;
     encrypt(plaintext: string): string;
     decrypt(value: string): string;
+    /**
+     * Generate a new encryption key, write it to disk, and increment the key version.
+     * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+     * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+     */
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
     private loadOrCreateKey;
 }
 /**
@@ -67,5 +86,25 @@ declare function migratePlaintextSecrets(configPath: string, vault: SecretVault,
     migrated: number;
     file: string;
 }>;
+/**
+ * Rotate the vault's encryption key and re-encrypt all secret-bearing
+ * fields in a config file. This is the atomic key rotation operation:
+ *
+ * 1. Read the config file
+ * 2. Decrypt all encrypted values with the old key
+ * 3. Generate a new key (vault.rotateKey())
+ * 4. Re-encrypt all values with the new key (new version prefix)
+ * 5. Write the config file atomically
+ *
+ * Returns the number of fields re-encrypted and the version transition.
+ * If the config file doesn't exist or has no encrypted fields, returns
+ * { rotated: 0 } without modifying the key.
+ */
+declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVault, logger?: Pick<Logger, 'warn' | 'info'>): Promise<{
+    rotated: number;
+    oldVersion: number;
+    newVersion: number;
+    file: string;
+}>;
 
-export { DefaultSecretScrubber as D, type SecretVaultOptions as S, DefaultSecretVault as a, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };
+export { DefaultSecretScrubber as D, type SecretVaultOptions as S, DefaultSecretVault as a, rotateConfigKeys as b, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };

package/dist/secret-vault-BAKpgFw_.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SecretVault encrypts secrets-at-rest in config files. The wire format is
+ * `enc:v<N>:<base64-iv>:<base64-tag>:<base64-ciphertext>` where `<N>` is the
+ * key version used for encryption. Plaintext strings (those that do not match
+ * this prefix) are passed through unchanged so that existing configs and
+ * env-var-derived values keep working.
+ *
+ * Key rotation produces a new key and re-encrypts all secrets under it.
+ * After rotation, `encrypt()` emits the new version prefix (e.g. `enc:v2:`)
+ * and `decrypt()` accepts any version prefix — it uses the current key
+ * regardless, since rotation re-encrypts every value atomically.
+ *
+ * The vault is intentionally NOT designed to defeat a determined local
+ * attacker who can read both the config file and the key file — that level
+ * of secrecy needs the OS keychain. The goal is to keep keys from being
+ * visible in screen shares, accidental log captures, and `cat config.json`
+ * over someone's shoulder.
+ */
+interface SecretVault {
+    encrypt(plaintext: string): string;
+    decrypt(value: string): string;
+    isEncrypted(value: string): boolean;
+    /** Current key version. Starts at 1; incremented by `rotateKey()`. */
+    readonly keyVersion: number;
+}
+/**
+ * RotatableSecretVault extends SecretVault with key rotation support.
+ * `rotateKey()` generates a fresh key, writes it to disk, and increments
+ * the key version. All subsequent `encrypt()` calls use the new version
+ * prefix. The caller is responsible for re-encrypting existing config
+ * values (see `rotateConfigKeys()`).
+ */
+interface RotatableSecretVault extends SecretVault {
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
+}
+/**
+ * Return the encrypted prefix for a given key version.
+ * @example encryptedPrefixForVersion(1) // 'enc:v1:'
+ * @example encryptedPrefixForVersion(2) // 'enc:v2:'
+ */
+declare function encryptedPrefixForVersion(version: number): string;
+/**
+ * Parse the key version from an encrypted value string.
+ * Returns undefined if the string is not an encrypted value.
+ */
+declare function parseEncryptedVersion(value: string): number | undefined;
+/**
+ * No-op SecretVault that passes values through unchanged.
+ * Used in contexts where encryption is not needed — e.g. reading/writing
+ * config sections that contain no secret fields (models, settings, etc.).
+ */
+declare const noOpVault: SecretVault;
+
+export { type RotatableSecretVault as R, type SecretVault as S, encryptedPrefixForVersion as e, noOpVault as n, parseEncryptedVersion as p };

package/dist/security/index.d.ts

@@ -1,9 +1,9 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CDvDYXWX.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-DEXOfnpm.js';
-import '../permission-BJ7eO9Vl.js';
-import '../context-JFOVvu6z.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-B2yw84VT.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-CkjSXabK.js';
+import '../permission-B9SB45lp.js';
+import '../context-MRk5PhNv.js';
 import '../logger-B63L5bTg.js';
-import '../secret-vault-BJDY28ev.js';
+import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';
 
 /**