causantic 0.2.0

package/dist/utils/logger.js

@@ -0,0 +1,104 @@
+/**
+ * Centralized logging for Causantic.
+ *
+ * Provides structured logging with levels, metadata, and output formatting.
+ * Writes to stderr to avoid interfering with stdio-based protocols.
+ *
+ * Log level is controlled via:
+ * 1. CAUSANTIC_LOG_LEVEL environment variable
+ * 2. setLogLevel() function
+ *
+ * Levels (in order of severity): debug < info < warn < error
+ */
+// Level priority (higher = more severe)
+const LEVEL_PRIORITY = {
+    debug: 0,
+    info: 1,
+    warn: 2,
+    error: 3,
+    silent: 4,
+};
+// Current log level
+let currentLevel = process.env.CAUSANTIC_LOG_LEVEL ?? 'info';
+// JSON output mode (for machine parsing)
+let jsonMode = process.env.CAUSANTIC_LOG_JSON === 'true';
+/**
+ * Set the log level.
+ */
+export function setLogLevel(level) {
+    currentLevel = level;
+}
+/**
+ * Get the current log level.
+ */
+export function getLogLevel() {
+    return currentLevel;
+}
+/**
+ * Enable or disable JSON output mode.
+ */
+export function setJsonMode(enabled) {
+    jsonMode = enabled;
+}
+/**
+ * Check if a level should be logged.
+ */
+function shouldLog(level) {
+    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[currentLevel];
+}
+/**
+ * Format a log entry for output.
+ */
+function format(entry) {
+    if (jsonMode) {
+        return JSON.stringify(entry);
+    }
+    const { timestamp, level, message, meta } = entry;
+    const time = timestamp.split('T')[1].split('.')[0]; // HH:MM:SS
+    const levelTag = level.toUpperCase().padEnd(5);
+    let output = `[${time}] ${levelTag} ${message}`;
+    if (meta && Object.keys(meta).length > 0) {
+        const metaStr = Object.entries(meta)
+            .map(([k, v]) => `${k}=${typeof v === 'object' ? JSON.stringify(v) : v}`)
+            .join(' ');
+        output += ` (${metaStr})`;
+    }
+    return output;
+}
+/**
+ * Write a log entry.
+ */
+function log(level, msg, meta) {
+    if (!shouldLog(level))
+        return;
+    const entry = {
+        timestamp: new Date().toISOString(),
+        level,
+        message: msg,
+        meta,
+    };
+    process.stderr.write(format(entry) + '\n');
+}
+/**
+ * Main logger instance.
+ */
+export const logger = {
+    debug: (msg, meta) => log('debug', msg, meta),
+    info: (msg, meta) => log('info', msg, meta),
+    warn: (msg, meta) => log('warn', msg, meta),
+    error: (msg, meta) => log('error', msg, meta),
+};
+/**
+ * Create a child logger with a fixed prefix.
+ */
+export function createLogger(prefix) {
+    return {
+        debug: (msg, meta) => log('debug', `[${prefix}] ${msg}`, meta),
+        info: (msg, meta) => log('info', `[${prefix}] ${msg}`, meta),
+        warn: (msg, meta) => log('warn', `[${prefix}] ${msg}`, meta),
+        error: (msg, meta) => log('error', `[${prefix}] ${msg}`, meta),
+    };
+}
+// Export default logger
+export default logger;
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAqBH,wCAAwC;AACxC,MAAM,cAAc,GAA6B;IAC/C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,oBAAoB;AACpB,IAAI,YAAY,GAAc,OAAO,CAAC,GAAG,CAAC,mBAAgC,IAAI,MAAM,CAAC;AAErF,yCAAyC;AACzC,IAAI,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AAEzD;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,QAAQ,GAAG,OAAO,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAkC;IACnD,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,KAAe;IAC7B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE/C,IAAI,MAAM,GAAG,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;IAEhD,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,OAAO,GAAG,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,GAAG,CAAC,KAAkC,EAAE,GAAW,EAAE,IAA8B;IAC1F,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO;IAE9B,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;QACL,OAAO,EAAE,GAAG;QACZ,IAAI;KACL,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAW;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;IAC3C,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;IAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC;QAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC;QAC5D,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC;QAC5D,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,wBAAwB;AACxB,eAAe,MAAM,CAAC"}

package/dist/utils/secret-store.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Cross-platform secret storage abstraction.
+ *
+ * Supports:
+ * - macOS: Keychain (via security CLI)
+ * - Linux: libsecret (via secret-tool CLI)
+ * - Fallback: Encrypted file storage
+ *
+ * Usage:
+ *   const store = await SecretStore.create();
+ *   await store.set('anthropic', 'sk-ant-...');
+ *   const key = await store.get('anthropic');
+ */
+/** Secret store interface */
+export interface SecretStore {
+    /** Get a secret by key name */
+    get(key: string): Promise<string | null>;
+    /** Set a secret */
+    set(key: string, value: string): Promise<void>;
+    /** Delete a secret */
+    delete(key: string): Promise<boolean>;
+    /** Check if the store is available */
+    isAvailable(): boolean;
+    /** Get the store type name */
+    readonly type: string;
+}
+/**
+ * macOS Keychain secret store.
+ */
+declare class KeychainStore implements SecretStore {
+    readonly type = "keychain";
+    isAvailable(): boolean;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+/**
+ * Linux libsecret store (GNOME Keyring / KDE Wallet via secret-tool).
+ */
+declare class LibsecretStore implements SecretStore {
+    readonly type = "libsecret";
+    isAvailable(): boolean;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+/**
+ * Encrypted file-based secret store (fallback).
+ * Uses AES-256-GCM with password-derived key.
+ */
+declare class EncryptedFileStore implements SecretStore {
+    readonly type = "encrypted-file";
+    private password;
+    private filePath;
+    constructor(filePath?: string);
+    isAvailable(): boolean;
+    setPassword(password: string): void;
+    private ensurePassword;
+    private deriveKey;
+    private loadSecrets;
+    private saveSecrets;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+/**
+ * Environment variable store (read-only for compatibility).
+ */
+declare class EnvStore implements SecretStore {
+    readonly type = "environment";
+    private readonly prefix;
+    constructor(prefix?: string);
+    isAvailable(): boolean;
+    get(key: string): Promise<string | null>;
+    set(_key: string, _value: string): Promise<void>;
+    delete(_key: string): Promise<boolean>;
+}
+/**
+ * Composite secret store that tries multiple backends in order.
+ */
+declare class CompositeStore implements SecretStore {
+    readonly type = "composite";
+    private stores;
+    private writeStore;
+    constructor(stores: SecretStore[], writeStore?: SecretStore);
+    isAvailable(): boolean;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+/**
+ * Create the default secret store for the current platform.
+ *
+ * Order of preference:
+ * 1. Environment variables (read-only, always checked first)
+ * 2. macOS Keychain (darwin)
+ * 3. Linux libsecret (linux with secret-tool)
+ * 4. Encrypted file (fallback)
+ */
+export declare function createSecretStore(options?: {
+    encryptedFilePath?: string;
+    password?: string;
+}): SecretStore;
+/**
+ * Get API key from the secret store or environment variable.
+ * Convenience function that matches the old keychain.ts API.
+ */
+export declare function getApiKey(keyName: string): Promise<string | null>;
+export { KeychainStore, LibsecretStore, EncryptedFileStore, EnvStore, CompositeStore };
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/utils/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/utils/secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,6BAA6B;AAC7B,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,mBAAmB;IACnB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,sBAAsB;IACtB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,sCAAsC;IACtC,WAAW,IAAI,OAAO,CAAC;IACvB,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,cAAM,aAAc,YAAW,WAAW;IACxC,QAAQ,CAAC,IAAI,cAAc;IAE3B,WAAW,IAAI,OAAO;IAYhB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAaxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAY5C;AAED;;GAEG;AACH,cAAM,cAAe,YAAW,WAAW;IACzC,QAAQ,CAAC,IAAI,eAAe;IAE5B,WAAW,IAAI,OAAO;IAYhB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAY5C;AAED;;;GAGG;AACH,cAAM,kBAAmB,YAAW,WAAW;IAC7C,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAS;gBAEb,QAAQ,CAAC,EAAE,MAAM;IAI7B,WAAW,IAAI,OAAO;IAItB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,WAAW;IA0Bb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAaxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAa5C;AAED;;GAEG;AACH,cAAM,QAAS,YAAW,WAAW;IACnC,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,MAAM,SAAe;IAIjC,WAAW,IAAI,OAAO;IAIhB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG7C;AAED;;GAEG;AACH,cAAM,cAAe,YAAW,WAAW;IACzC,QAAQ,CAAC,IAAI,eAAe;IAC5B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAc;gBAEpB,MAAM,EAAE,WAAW,EAAE,EAAE,UAAU,CAAC,EAAE,WAAW;IAK3D,WAAW,IAAI,OAAO;IAIhB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAexC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAM5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,WAAW,CA4Bd;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAGD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC"}

package/dist/utils/secret-store.js

@@ -0,0 +1,340 @@
+/**
+ * Cross-platform secret storage abstraction.
+ *
+ * Supports:
+ * - macOS: Keychain (via security CLI)
+ * - Linux: libsecret (via secret-tool CLI)
+ * - Fallback: Encrypted file storage
+ *
+ * Usage:
+ *   const store = await SecretStore.create();
+ *   await store.set('anthropic', 'sk-ant-...');
+ *   const key = await store.get('anthropic');
+ */
+import { spawnSync, execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { resolvePath } from '../config/memory-config.js';
+const SERVICE_NAME = 'causantic';
+const ENCRYPTED_FILE_PATH = '~/.causantic/.secrets.enc';
+/**
+ * macOS Keychain secret store.
+ */
+class KeychainStore {
+    type = 'keychain';
+    isAvailable() {
+        if (process.platform !== 'darwin') {
+            return false;
+        }
+        try {
+            execFileSync('which', ['security'], { stdio: 'ignore' });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async get(key) {
+        try {
+            const result = execFileSync('security', ['find-generic-password', '-a', key, '-s', SERVICE_NAME, '-w'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] });
+            return result.trim();
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(key, value) {
+        // Delete existing entry if present
+        try {
+            execFileSync('security', ['delete-generic-password', '-a', key, '-s', SERVICE_NAME], { stdio: ['pipe', 'ignore', 'ignore'] });
+        }
+        catch {
+            // Ignore - entry may not exist
+        }
+        // Add new entry — uses execFileSync to avoid shell interpretation of special chars
+        execFileSync('security', ['add-generic-password', '-a', key, '-s', SERVICE_NAME, '-w', value], { encoding: 'utf-8' });
+    }
+    async delete(key) {
+        try {
+            execFileSync('security', ['delete-generic-password', '-a', key, '-s', SERVICE_NAME], { stdio: ['pipe', 'ignore', 'ignore'] });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/**
+ * Linux libsecret store (GNOME Keyring / KDE Wallet via secret-tool).
+ */
+class LibsecretStore {
+    type = 'libsecret';
+    isAvailable() {
+        if (process.platform !== 'linux') {
+            return false;
+        }
+        try {
+            const result = spawnSync('which', ['secret-tool'], { encoding: 'utf-8' });
+            return result.status === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    async get(key) {
+        try {
+            const result = spawnSync('secret-tool', ['lookup', 'service', SERVICE_NAME, 'account', key], { encoding: 'utf-8' });
+            if (result.status === 0 && result.stdout) {
+                return result.stdout.trim();
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(key, value) {
+        const result = spawnSync('secret-tool', ['store', '--label', `${SERVICE_NAME}:${key}`, 'service', SERVICE_NAME, 'account', key], {
+            input: value,
+            encoding: 'utf-8',
+        });
+        if (result.status !== 0) {
+            throw new Error(`Failed to store secret: ${result.stderr}`);
+        }
+    }
+    async delete(key) {
+        try {
+            const result = spawnSync('secret-tool', ['clear', 'service', SERVICE_NAME, 'account', key], { encoding: 'utf-8' });
+            return result.status === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/**
+ * Encrypted file-based secret store (fallback).
+ * Uses AES-256-GCM with password-derived key.
+ */
+class EncryptedFileStore {
+    type = 'encrypted-file';
+    password = null;
+    filePath;
+    constructor(filePath) {
+        this.filePath = resolvePath(filePath ?? ENCRYPTED_FILE_PATH);
+    }
+    isAvailable() {
+        return true; // Always available as fallback
+    }
+    setPassword(password) {
+        this.password = password;
+    }
+    ensurePassword() {
+        if (!this.password) {
+            // Check environment variable
+            const envPassword = process.env.CAUSANTIC_SECRET_PASSWORD;
+            if (envPassword) {
+                this.password = envPassword;
+            }
+            else {
+                throw new Error('No password set for encrypted file store. ' +
+                    'Set CAUSANTIC_SECRET_PASSWORD environment variable or call setPassword().');
+            }
+        }
+        return this.password;
+    }
+    deriveKey(password, salt) {
+        return scryptSync(password, salt, 32);
+    }
+    loadSecrets() {
+        if (!existsSync(this.filePath)) {
+            return {};
+        }
+        const password = this.ensurePassword();
+        const fileContent = readFileSync(this.filePath);
+        // Format: salt (16) + nonce (12) + authTag (16) + ciphertext
+        const salt = fileContent.subarray(0, 16);
+        const nonce = fileContent.subarray(16, 28);
+        const authTag = fileContent.subarray(28, 44);
+        const ciphertext = fileContent.subarray(44);
+        const key = this.deriveKey(password, salt);
+        const decipher = createDecipheriv('aes-256-gcm', key, nonce);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final(),
+        ]);
+        return JSON.parse(decrypted.toString('utf-8'));
+    }
+    saveSecrets(secrets) {
+        const password = this.ensurePassword();
+        const salt = randomBytes(16);
+        const nonce = randomBytes(12);
+        const key = this.deriveKey(password, salt);
+        const cipher = createCipheriv('aes-256-gcm', key, nonce);
+        const plaintext = Buffer.from(JSON.stringify(secrets), 'utf-8');
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        // Ensure directory exists
+        const dir = dirname(this.filePath);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        // Write: salt + nonce + authTag + ciphertext
+        const output = Buffer.concat([salt, nonce, authTag, ciphertext]);
+        writeFileSync(this.filePath, output);
+    }
+    async get(key) {
+        try {
+            const secrets = this.loadSecrets();
+            return secrets[key] ?? null;
+        }
+        catch (error) {
+            if (error.message.includes('No password set')) {
+                throw error;
+            }
+            // Decryption failed - wrong password or corrupted file
+            return null;
+        }
+    }
+    async set(key, value) {
+        let secrets = {};
+        try {
+            secrets = this.loadSecrets();
+        }
+        catch {
+            // Start fresh if file doesn't exist or can't be decrypted
+        }
+        secrets[key] = value;
+        this.saveSecrets(secrets);
+    }
+    async delete(key) {
+        try {
+            const secrets = this.loadSecrets();
+            if (key in secrets) {
+                delete secrets[key];
+                this.saveSecrets(secrets);
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/**
+ * Environment variable store (read-only for compatibility).
+ */
+class EnvStore {
+    type = 'environment';
+    prefix;
+    constructor(prefix = 'CAUSANTIC_') {
+        this.prefix = prefix;
+    }
+    isAvailable() {
+        return true;
+    }
+    async get(key) {
+        // Try with prefix first, then without
+        const prefixedKey = `${this.prefix}${key.toUpperCase()}_KEY`;
+        const directKey = key.toUpperCase();
+        return process.env[prefixedKey] ?? process.env[directKey] ?? null;
+    }
+    async set(_key, _value) {
+        throw new Error('Cannot set environment variables at runtime');
+    }
+    async delete(_key) {
+        throw new Error('Cannot delete environment variables at runtime');
+    }
+}
+/**
+ * Composite secret store that tries multiple backends in order.
+ */
+class CompositeStore {
+    type = 'composite';
+    stores;
+    writeStore;
+    constructor(stores, writeStore) {
+        this.stores = stores;
+        this.writeStore = writeStore ?? stores[0];
+    }
+    isAvailable() {
+        return this.stores.some((s) => s.isAvailable());
+    }
+    async get(key) {
+        for (const store of this.stores) {
+            if (!store.isAvailable())
+                continue;
+            try {
+                const value = await store.get(key);
+                if (value !== null) {
+                    return value;
+                }
+            }
+            catch {
+                // Try next store
+            }
+        }
+        return null;
+    }
+    async set(key, value) {
+        if (!this.writeStore.isAvailable()) {
+            throw new Error(`Write store (${this.writeStore.type}) is not available`);
+        }
+        return this.writeStore.set(key, value);
+    }
+    async delete(key) {
+        if (!this.writeStore.isAvailable()) {
+            return false;
+        }
+        return this.writeStore.delete(key);
+    }
+}
+/**
+ * Create the default secret store for the current platform.
+ *
+ * Order of preference:
+ * 1. Environment variables (read-only, always checked first)
+ * 2. macOS Keychain (darwin)
+ * 3. Linux libsecret (linux with secret-tool)
+ * 4. Encrypted file (fallback)
+ */
+export function createSecretStore(options) {
+    const stores = [];
+    // Always check environment variables first
+    stores.push(new EnvStore());
+    // Platform-specific secure stores
+    const keychain = new KeychainStore();
+    if (keychain.isAvailable()) {
+        stores.push(keychain);
+    }
+    const libsecret = new LibsecretStore();
+    if (libsecret.isAvailable()) {
+        stores.push(libsecret);
+    }
+    // Encrypted file fallback
+    const encryptedFile = new EncryptedFileStore(options?.encryptedFilePath);
+    if (options?.password) {
+        encryptedFile.setPassword(options.password);
+    }
+    stores.push(encryptedFile);
+    // Determine write store (first non-env store that's available)
+    const writeStore = stores.find((s) => s.type !== 'environment' && s.isAvailable());
+    return new CompositeStore(stores, writeStore);
+}
+/**
+ * Get API key from the secret store or environment variable.
+ * Convenience function that matches the old keychain.ts API.
+ */
+export async function getApiKey(keyName) {
+    const store = createSecretStore();
+    return store.get(keyName);
+}
+// Export store implementations for testing
+export { KeychainStore, LibsecretStore, EncryptedFileStore, EnvStore, CompositeStore };
+//# sourceMappingURL=secret-store.js.map

package/dist/utils/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/utils/secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAQ,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAgBxD;;GAEG;AACH,MAAM,aAAa;IACR,IAAI,GAAG,UAAU,CAAC;IAE3B,WAAW;QACT,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAC9D,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACzD,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,mCAAmC;QACnC,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,EAC1D,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QAED,mFAAmF;QACnF,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,EACpE,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,EAC1D,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,cAAc;IACT,IAAI,GAAG,WAAW,CAAC;IAE5B,WAAW;QACT,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CACtB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,EACnD,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,MAAM,GAAG,SAAS,CACtB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,EACvF;YACE,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO;SAClB,CACF,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CACtB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,EAClD,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,kBAAkB;IACb,IAAI,GAAG,gBAAgB,CAAC;IACzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,QAAQ,CAAS;IAEzB,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,IAAI,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAC9C,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,6BAA6B;YAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,4CAA4C;oBAC5C,2EAA2E,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,SAAS,CAAC,QAAgB,EAAE,IAAY;QAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEhD,6DAA6D;QAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAEO,WAAW,CAAC,OAA+B;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAEhE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,0BAA0B;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACjE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACzD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,uDAAuD;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,OAAO,GAA2B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,QAAQ;IACH,IAAI,GAAG,aAAa,CAAC;IACb,MAAM,CAAS;IAEhC,YAAY,MAAM,GAAG,YAAY;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,sCAAsC;QACtC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7D,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAEpC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,MAAc;QACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,cAAc;IACT,IAAI,GAAG,WAAW,CAAC;IACpB,MAAM,CAAgB;IACtB,UAAU,CAAc;IAEhC,YAAY,MAAqB,EAAE,UAAwB;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAGjC;IACC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,2CAA2C;IAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAE5B,kCAAkC;IAClC,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;IACvC,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,0BAA0B;IAC1B,MAAM,aAAa,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACzE,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE3B,+DAA+D;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEnF,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,2CAA2C;AAC3C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC"}

package/dist/utils/secure-buffer.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Secure buffer utilities for handling sensitive data.
+ *
+ * Provides memory protection by zeroing buffers when done.
+ */
+/**
+ * Secure buffer that zeros memory when cleared.
+ *
+ * Use for encryption keys, passwords, and other sensitive data that
+ * should not linger in memory after use.
+ *
+ * @example
+ * ```typescript
+ * const keyBuffer = new SecureBuffer(secretKey);
+ * try {
+ *   db.pragma(`key = '${keyBuffer.toString()}'`);
+ * } finally {
+ *   keyBuffer.clear();
+ * }
+ * ```
+ */
+export declare class SecureBuffer {
+    private buffer;
+    private cleared;
+    constructor(data: string | Buffer);
+    /**
+     * Get the buffer contents as a string.
+     * @throws Error if buffer has been cleared
+     */
+    toString(encoding?: BufferEncoding): string;
+    /**
+     * Get a copy of the raw buffer.
+     * @throws Error if buffer has been cleared
+     */
+    toBuffer(): Buffer;
+    /**
+     * Check if the buffer has been cleared.
+     */
+    isCleared(): boolean;
+    /**
+     * Get the length of the buffer.
+     */
+    get length(): number;
+    /**
+     * Zero the buffer memory and mark as cleared.
+     * Safe to call multiple times.
+     */
+    clear(): void;
+}
+/**
+ * Execute a function with a secure buffer, ensuring cleanup.
+ *
+ * @example
+ * ```typescript
+ * await withSecureBuffer(password, (buf) => {
+ *   db.pragma(`key = '${buf.toString()}'`);
+ * });
+ * // Buffer is automatically cleared
+ * ```
+ */
+export declare function withSecureBuffer<T>(data: string | Buffer, fn: (buffer: SecureBuffer) => T | Promise<T>): Promise<T>;
+/**
+ * Synchronous version of withSecureBuffer.
+ */
+export declare function withSecureBufferSync<T>(data: string | Buffer, fn: (buffer: SecureBuffer) => T): T;
+//# sourceMappingURL=secure-buffer.d.ts.map

package/dist/utils/secure-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-buffer.d.ts","sourceRoot":"","sources":["../../src/utils/secure-buffer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,MAAM,GAAG,MAAM;IAIjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,GAAE,cAAwB,GAAG,MAAM;IAOpD;;;OAGG;IACH,QAAQ,IAAI,MAAM;IAOlB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;OAGG;IACH,KAAK,IAAI,IAAI;CAOd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,CAAC,GAC9B,CAAC,CAOH"}