agentvault 1.0.2 → 1.0.5

package/dist/src/vault/secret-leak-detector.js

@@ -0,0 +1,218 @@
+/**
+ * Secret Leak Detector
+ *
+ * Monitors for accidental secret leakage through common vectors:
+ *
+ * - Environment variables visible to child processes
+ * - Process arguments (visible via `ps`)
+ * - stdout/stderr output
+ * - Log files
+ *
+ * When a leak is detected, the detector can:
+ * 1. Emit an event for audit logging
+ * 2. Attempt automatic remediation (e.g. redact from env)
+ * 3. Optionally rotate the leaked secret
+ */
+import * as crypto from 'node:crypto';
+export class SecretLeakDetector {
+    tracked = new Map();
+    events = [];
+    onLeak;
+    autoRemediate;
+    scanProcessArgs;
+    scanEnv;
+    /**
+     * Captured original stdout.write so we can intercept writes.
+     * We only set this up once and restore on dispose.
+     */
+    originalStdoutWrite = null;
+    originalStderrWrite = null;
+    intercepting = false;
+    constructor(options) {
+        this.onLeak = options?.onLeak ?? null;
+        this.autoRemediate = options?.autoRemediate ?? true;
+        this.scanProcessArgs = options?.scanProcessArgs ?? true;
+        this.scanEnv = options?.scanEnv ?? true;
+    }
+    // -----------------------------------------------------------------------
+    // Secret tracking
+    // -----------------------------------------------------------------------
+    /**
+     * Register a secret value for leak monitoring.
+     * The plaintext is fingerprinted and NOT stored.
+     */
+    track(key, value) {
+        this.tracked.set(key, {
+            key,
+            fingerprint: crypto.createHash('sha256').update(value).digest('hex'),
+            prefix: value.slice(0, 4),
+            length: value.length,
+        });
+    }
+    /**
+     * Stop tracking a secret.
+     */
+    untrack(key) {
+        this.tracked.delete(key);
+    }
+    // -----------------------------------------------------------------------
+    // Scanning
+    // -----------------------------------------------------------------------
+    /**
+     * Scan the current process environment for leaked secrets.
+     * Checks if any tracked secret value appears as an env var value.
+     */
+    scanEnvironment(secretValues) {
+        if (!this.scanEnv)
+            return [];
+        const detected = [];
+        for (const [envKey, envValue] of Object.entries(process.env)) {
+            if (!envValue)
+                continue;
+            for (const [secretKey, secretValue] of secretValues) {
+                if (envValue === secretValue || envValue.includes(secretValue)) {
+                    const event = this.createEvent('critical', secretKey, `Secret "${secretKey}" found in environment variable "${envKey}"`, 'env');
+                    if (this.autoRemediate) {
+                        delete process.env[envKey];
+                        event.remediated = true;
+                        event.remediationAction = `Removed env var "${envKey}"`;
+                    }
+                    detected.push(event);
+                }
+            }
+        }
+        return detected;
+    }
+    /**
+     * Scan process.argv for leaked secrets.
+     */
+    scanProcessArguments(secretValues) {
+        if (!this.scanProcessArgs)
+            return [];
+        const detected = [];
+        for (const arg of process.argv) {
+            for (const [secretKey, secretValue] of secretValues) {
+                if (arg.includes(secretValue)) {
+                    const event = this.createEvent('critical', secretKey, `Secret "${secretKey}" found in process arguments (visible via ps)`, 'process-args');
+                    // Cannot remediate process.argv after the fact
+                    detected.push(event);
+                }
+            }
+        }
+        return detected;
+    }
+    /**
+     * Check if a string contains any tracked secret values.
+     * Used for scanning log output, stdout, etc.
+     */
+    scanString(text, source, secretValues) {
+        const detected = [];
+        for (const [secretKey, secretValue] of secretValues) {
+            if (text.includes(secretValue)) {
+                detected.push(this.createEvent(source === 'stdout' ? 'warning' : 'critical', secretKey, `Secret "${secretKey}" detected in ${source} output`, source));
+            }
+        }
+        return detected;
+    }
+    /**
+     * Install stdout/stderr interceptors that redact tracked secrets.
+     * Call `dispose()` to remove the interceptors.
+     */
+    installOutputInterceptors(secretValues) {
+        if (this.intercepting)
+            return;
+        this.intercepting = true;
+        this.originalStdoutWrite = process.stdout.write.bind(process.stdout);
+        this.originalStderrWrite = process.stderr.write.bind(process.stderr);
+        process.stdout.write = ((chunk, ...args) => {
+            const str = typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : String(chunk);
+            const redacted = this.redactSecrets(str, secretValues);
+            if (redacted !== str) {
+                // Leak detected in stdout
+                for (const [secretKey, secretValue] of secretValues) {
+                    if (str.includes(secretValue)) {
+                        this.createEvent('warning', secretKey, `Secret "${secretKey}" redacted from stdout`, 'stdout');
+                    }
+                }
+            }
+            return this.originalStdoutWrite.call(process.stdout, redacted, ...args);
+        });
+        process.stderr.write = ((chunk, ...args) => {
+            const str = typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : String(chunk);
+            const redacted = this.redactSecrets(str, secretValues);
+            return this.originalStderrWrite.call(process.stderr, redacted, ...args);
+        });
+    }
+    /**
+     * Remove stdout/stderr interceptors.
+     */
+    removeOutputInterceptors() {
+        if (!this.intercepting)
+            return;
+        if (this.originalStdoutWrite) {
+            process.stdout.write = this.originalStdoutWrite;
+            this.originalStdoutWrite = null;
+        }
+        if (this.originalStderrWrite) {
+            process.stderr.write = this.originalStderrWrite;
+            this.originalStderrWrite = null;
+        }
+        this.intercepting = false;
+    }
+    // -----------------------------------------------------------------------
+    // Event retrieval
+    // -----------------------------------------------------------------------
+    /**
+     * Get all recorded leak events.
+     */
+    getEvents() {
+        return [...this.events];
+    }
+    /**
+     * Get events filtered by severity.
+     */
+    getEventsBySeverity(severity) {
+        return this.events.filter(e => e.severity === severity);
+    }
+    /**
+     * Clear recorded events.
+     */
+    clearEvents() {
+        this.events.length = 0;
+    }
+    /**
+     * Clean up interceptors and tracked secrets.
+     */
+    dispose() {
+        this.removeOutputInterceptors();
+        this.tracked.clear();
+        this.events.length = 0;
+    }
+    // -----------------------------------------------------------------------
+    // Internal
+    // -----------------------------------------------------------------------
+    redactSecrets(text, secretValues) {
+        let result = text;
+        for (const [, value] of secretValues) {
+            if (result.includes(value)) {
+                result = result.replaceAll(value, '[REDACTED]');
+            }
+        }
+        return result;
+    }
+    createEvent(severity, secretKey, description, source) {
+        const event = {
+            detectedAt: new Date().toISOString(),
+            severity,
+            description,
+            secretKey,
+            source,
+            remediated: false,
+        };
+        this.events.push(event);
+        if (this.onLeak)
+            this.onLeak(event);
+        return event;
+    }
+}
+//# sourceMappingURL=secret-leak-detector.js.map

package/dist/src/vault/secret-leak-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-leak-detector.js","sourceRoot":"","sources":["../../../src/vault/secret-leak-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AA6BtC,MAAM,OAAO,kBAAkB;IACZ,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC3C,MAAM,GAAyB,EAAE,CAAC;IAClC,MAAM,CAA2B;IACjC,aAAa,CAAU;IACvB,eAAe,CAAU;IACzB,OAAO,CAAU;IAElC;;;OAGG;IACK,mBAAmB,GAAuC,IAAI,CAAC;IAC/D,mBAAmB,GAAuC,IAAI,CAAC;IAC/D,YAAY,GAAG,KAAK,CAAC;IAE7B,YAAY,OAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAE1E;;;OAGG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,GAAG;YACH,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACpE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,GAAW;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,0EAA0E;IAC1E,WAAW;IACX,0EAA0E;IAE1E;;;OAGG;IACH,eAAe,CAAC,YAAiC;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAE1C,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;gBACpD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAC5B,UAAU,EACV,SAAS,EACT,WAAW,SAAS,oCAAoC,MAAM,GAAG,EACjE,KAAK,CACN,CAAC;oBAEF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAC3B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;wBACxB,KAAK,CAAC,iBAAiB,GAAG,oBAAoB,MAAM,GAAG,CAAC;oBAC1D,CAAC;oBAED,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,YAAiC;QACpD,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAE1C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;gBACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAC5B,UAAU,EACV,SAAS,EACT,WAAW,SAAS,+CAA+C,EACnE,cAAc,CACf,CAAC;oBACF,+CAA+C;oBAC/C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,MAAoC,EAAE,YAAiC;QAC9F,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAE1C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CACX,IAAI,CAAC,WAAW,CACd,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAC5C,SAAS,EACT,WAAW,SAAS,iBAAiB,MAAM,SAAS,EACpD,MAAM,CACP,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,YAAiC;QACzD,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAEzB,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAW,EAAE;YACtE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1G,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAEvD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,0BAA0B;gBAC1B,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;oBACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9B,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,SAAS,wBAAwB,EAAE,QAAQ,CAAC,CAAC;oBACjG,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,mBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAI,IAAW,CAAC,CAAC;QACnF,CAAC,CAAgC,CAAC;QAElC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAW,EAAE;YACtE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1G,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,mBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAI,IAAW,CAAC,CAAC;QACnF,CAAC,CAAgC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,wBAAwB;QACtB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QAE/B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC;YAChD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC;YAChD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAE1E;;OAEG;IACH,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAsB;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,WAAW;IACX,0EAA0E;IAElE,aAAa,CAAC,IAAY,EAAE,YAAiC;QACnE,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CACjB,QAAsB,EACtB,SAAiB,EACjB,WAAmB,EACnB,MAAoC;QAEpC,MAAM,KAAK,GAAuB;YAChC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,QAAQ;YACR,WAAW;YACX,SAAS;YACT,MAAM;YACN,UAAU,EAAE,KAAK;SAClB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpC,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/src/vault/secret-management-layer.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Secret Management Layer – Unified Orchestrator
+ *
+ * Brings together all Agent Safehouse-inspired components into a single
+ * coherent API:
+ *
+ * - **SecretSandbox**: Deny-first access control with scoped grants
+ * - **EncryptedMemoryStore**: AES-256-GCM encrypted in-memory cache
+ * - **SecretRotationManager**: Automatic secret rotation
+ * - **SecretLeakDetector**: Leak monitoring and auto-redaction
+ * - **SecretInjector**: Safe secret delivery to agent processes
+ * - **SecretAccessAudit**: Hash-chained tamper-evident audit trail
+ *
+ * Usage:
+ * ```ts
+ * const sml = SecretManagementLayer.create({
+ *   backend: 'memory',   // or 'hashicorp' / 'bitwarden'
+ *   leakDetection: true,
+ *   auditEnabled: true,
+ * });
+ *
+ * const scope = sml.createScope({
+ *   agentId: 'my-agent',
+ *   grants: [{ keyPattern: 'api_*', access: 'read' }],
+ * });
+ *
+ * sml.enterScope(scope.scopeId);
+ * const value = await sml.getSecret('api_key');
+ * sml.exitScope();
+ * sml.dispose();
+ * ```
+ */
+import type { SecretProvider } from './provider.js';
+import type { SecretManagementLayerConfig, SecretManagementStats, SecretSandboxScope, SecretRotationConfig, SecretRotationState, LeakDetectionEvent, SecretAuditEntry, InjectionMethod, InjectedSecret } from './safehouse-types.js';
+import { SecretSandbox, type CreateScopeOptions } from './secret-sandbox.js';
+import { EncryptedMemoryStore } from './encrypted-memory-store.js';
+import { SecretRotationManager } from './secret-rotation.js';
+import { SecretLeakDetector } from './secret-leak-detector.js';
+import { SecretInjector } from './secret-injector.js';
+import { SecretAccessAudit } from './secret-audit.js';
+export declare class SecretManagementLayer {
+    readonly sandbox: SecretSandbox;
+    readonly memoryStore: EncryptedMemoryStore;
+    readonly rotation: SecretRotationManager;
+    readonly leakDetector: SecretLeakDetector;
+    readonly injector: SecretInjector;
+    readonly audit: SecretAccessAudit;
+    private readonly config;
+    private readonly startedAt;
+    /** Counters for stats */
+    private totalReads;
+    private totalWrites;
+    private totalDenied;
+    /** Active secret values for leak detection (key -> plaintext) */
+    private readonly activeSecrets;
+    private constructor();
+    /**
+     * Create a new SecretManagementLayer with the specified configuration.
+     */
+    static create(config?: SecretManagementLayerConfig): SecretManagementLayer;
+    /**
+     * Create with a custom provider.
+     */
+    static createWithProvider(provider: SecretProvider, config?: SecretManagementLayerConfig): SecretManagementLayer;
+    createScope(options: CreateScopeOptions): SecretSandboxScope;
+    enterScope(scopeId: string): void;
+    exitScope(): void;
+    revokeScope(scopeId: string): void;
+    /**
+     * Get a secret. The value is cached in the encrypted memory store.
+     */
+    getSecret(key: string): Promise<string | null>;
+    /**
+     * Store a secret through the sandbox.
+     */
+    storeSecret(key: string, value: string): Promise<void>;
+    /**
+     * Delete a secret through the sandbox.
+     */
+    deleteSecret(key: string): Promise<void>;
+    /**
+     * List accessible secrets through the sandbox.
+     */
+    listSecrets(): Promise<string[]>;
+    /**
+     * Inject a secret for an agent execution context.
+     */
+    injectSecret(key: string, method?: InjectionMethod): Promise<InjectedSecret>;
+    /**
+     * Build a child process environment with all env-scoped injected secrets.
+     */
+    buildChildEnv(baseEnv?: NodeJS.ProcessEnv): Record<string, string>;
+    /**
+     * Register a secret for automatic rotation.
+     */
+    registerRotation(config: SecretRotationConfig): void;
+    /**
+     * Manually rotate a secret.
+     */
+    rotateSecret(key: string): Promise<SecretRotationState>;
+    /**
+     * Run a full leak scan across environment, process args, and any custom text.
+     */
+    scanForLeaks(): LeakDetectionEvent[];
+    /**
+     * Scan a string for leaked secrets.
+     */
+    scanText(text: string, source?: LeakDetectionEvent['source']): LeakDetectionEvent[];
+    /**
+     * Get all recorded leak events.
+     */
+    getLeakEvents(): LeakDetectionEvent[];
+    /**
+     * Get operational statistics.
+     */
+    stats(): SecretManagementStats;
+    /**
+     * Check the health of the underlying provider.
+     */
+    healthCheck(): Promise<import("./provider.js").SecretProviderHealth>;
+    /**
+     * Get the audit trail.
+     */
+    getAuditEntries(): SecretAuditEntry[];
+    /**
+     * Verify audit chain integrity.
+     */
+    verifyAuditChain(): {
+        valid: boolean;
+        brokenAt?: number;
+        reason?: string;
+    };
+    /**
+     * Securely dispose of all components.
+     * After calling this, the layer is no longer usable.
+     */
+    dispose(): Promise<void>;
+}
+//# sourceMappingURL=secret-management-layer.d.ts.map

package/dist/src/vault/secret-management-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-management-layer.d.ts","sourceRoot":"","sources":["../../../src/vault/secret-management-layer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAKtD,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,yBAAyB;IACzB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,WAAW,CAAK;IAExB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAE3D,OAAO;IAsEP;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,qBAAqB;IAoB1E;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,2BAA2B,GAAG,qBAAqB;IAQhH,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB;IAI5D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IASjC,SAAS,IAAI,IAAI;IAKjB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQlC;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmCpD;;OAEG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5D;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS9C;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQtC;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAuBlF;;OAEG;IACH,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQlE;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIpD;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA0B7D;;OAEG;IACH,YAAY,IAAI,kBAAkB,EAAE;IAOpC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,kBAAkB,CAAC,QAAQ,CAAS,GAAG,kBAAkB,EAAE;IAI1F;;OAEG;IACH,aAAa,IAAI,kBAAkB,EAAE;IAQrC;;OAEG;IACH,KAAK,IAAI,qBAAqB;IAa9B;;OAEG;IACG,WAAW;IAIjB;;OAEG;IACH,eAAe,IAAI,gBAAgB,EAAE;IAIrC;;OAEG;IACH,gBAAgB,IAAI;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAQ1E;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ/B"}