chief-helm 0.1.1 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/Readme.md +23 -8
- package/dist/commands/secrets.d.ts +3 -3
- package/dist/commands/secrets.js +13 -13
- package/dist/commands/secrets.js.map +1 -1
- package/dist/commands/setup.js +2 -2
- package/dist/core/inputs.d.ts +2 -2
- package/dist/core/inputs.js +2 -2
- package/dist/core/repo.d.ts.map +1 -1
- package/dist/core/repo.js +1 -0
- package/dist/core/repo.js.map +1 -1
- package/dist/core/secrets.d.ts +31 -27
- package/dist/core/secrets.d.ts.map +1 -1
- package/dist/core/secrets.js +134 -61
- package/dist/core/secrets.js.map +1 -1
- package/dist/types/index.d.ts +7 -2
- package/dist/types/index.d.ts.map +1 -1
- package/package.json +6 -2
package/Readme.md
CHANGED
|
@@ -14,7 +14,7 @@ HELM is how a human operates the CHIEF personal AI operations system. Every flow
|
|
|
14
14
|
| npm | v9.0.0 | `npm --version` |
|
|
15
15
|
| Git | v2.30.0 | `git --version` |
|
|
16
16
|
|
|
17
|
-
**Platform:** macOS 12+ or Windows 10+.
|
|
17
|
+
**Platform:** macOS 12+ or Windows 10+.
|
|
18
18
|
|
|
19
19
|
**Node.js installation:** [nodejs.org](https://nodejs.org) → download the LTS version. This installs both `node` and `npm`.
|
|
20
20
|
|
|
@@ -70,10 +70,10 @@ helm config <n> # Open config file n in your editor (auto-commits
|
|
|
70
70
|
|
|
71
71
|
### Secrets
|
|
72
72
|
|
|
73
|
-
Credentials are
|
|
73
|
+
Credentials are encrypted with AES-256-GCM and stored locally. Values are never printed, logged, or included in error messages.
|
|
74
74
|
|
|
75
75
|
```bash
|
|
76
|
-
helm secrets set <KEY> # Masked input →
|
|
76
|
+
helm secrets set <KEY> # Masked input → encrypted local storage
|
|
77
77
|
helm secrets list # Key names only — values never shown
|
|
78
78
|
helm secrets verify <KEY> # Confirm a key exists
|
|
79
79
|
helm secrets delete <KEY> # Remove with confirmation prompt
|
|
@@ -172,7 +172,7 @@ The main CHIEF repo is never written to by HELM at runtime.
|
|
|
172
172
|
├── core/
|
|
173
173
|
│ ├── repo.ts conf store, local config, repo validation, setup guard
|
|
174
174
|
│ ├── config.ts YAML read/write for all instance repo config files
|
|
175
|
-
│ ├── secrets.ts
|
|
175
|
+
│ ├── secrets.ts AES-256-GCM encrypted storage, manifest management
|
|
176
176
|
│ ├── git.ts pull, commit, push, status via simple-git
|
|
177
177
|
│ ├── state.ts last_run.json and other state file I/O
|
|
178
178
|
│ └── inputs.ts Credential key map and per-input connectivity tests
|
|
@@ -206,15 +206,30 @@ Never swallow errors. Never put secret values in error messages.
|
|
|
206
206
|
|
|
207
207
|
### Publishing
|
|
208
208
|
|
|
209
|
+
Releases are automated via GitHub Actions. The workflow at `/.github/workflows/helm-release.yml` triggers on tags matching `helm-v*`.
|
|
210
|
+
|
|
211
|
+
**Using the release script:**
|
|
212
|
+
|
|
209
213
|
```bash
|
|
210
214
|
cd helm/
|
|
211
|
-
|
|
212
|
-
npm publish
|
|
213
|
-
git push && git push --tags
|
|
215
|
+
./scripts/release.sh 0.2.0 # bumps version, builds, commits, tags
|
|
216
|
+
git push origin main && git push origin helm-v0.2.0 # triggers CI → npm publish + GitHub Release
|
|
214
217
|
```
|
|
215
218
|
|
|
216
|
-
|
|
219
|
+
**Manual process:**
|
|
220
|
+
|
|
221
|
+
```bash
|
|
222
|
+
cd helm/
|
|
223
|
+
npm version 0.2.0 --no-git-tag-version
|
|
224
|
+
npm run build
|
|
225
|
+
cd ..
|
|
226
|
+
git add helm/package.json helm/package-lock.json
|
|
227
|
+
git commit -m "[helm-release] v0.2.0"
|
|
228
|
+
git tag helm-v0.2.0
|
|
229
|
+
git push origin main && git push origin helm-v0.2.0
|
|
230
|
+
```
|
|
217
231
|
|
|
232
|
+
`prepublishOnly` compiles TypeScript to `dist/` before every publish. Only `dist/` and `README.md` are included in the published package.
|
|
218
233
|
---
|
|
219
234
|
|
|
220
235
|
*HELM is part of the CHIEF personal AI operations system. See [SETUP.md](../SETUP.md) for full system documentation.*
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @file helm secrets —
|
|
2
|
+
* @file helm secrets — encrypted credential management.
|
|
3
3
|
*
|
|
4
4
|
* Subcommands:
|
|
5
|
-
* helm secrets set <key> Masked input →
|
|
5
|
+
* helm secrets set <key> Masked input → encrypted and stored locally
|
|
6
6
|
* helm secrets list Key names only, never values
|
|
7
|
-
* helm secrets verify <key> Confirm key exists in
|
|
7
|
+
* helm secrets verify <key> Confirm key exists in encrypted storage
|
|
8
8
|
* helm secrets delete <key> Remove with confirmation prompt
|
|
9
9
|
*
|
|
10
10
|
* Secret values are never printed, logged, or included in error messages.
|
package/dist/commands/secrets.js
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @file helm secrets —
|
|
2
|
+
* @file helm secrets — encrypted credential management.
|
|
3
3
|
*
|
|
4
4
|
* Subcommands:
|
|
5
|
-
* helm secrets set <key> Masked input →
|
|
5
|
+
* helm secrets set <key> Masked input → encrypted and stored locally
|
|
6
6
|
* helm secrets list Key names only, never values
|
|
7
|
-
* helm secrets verify <key> Confirm key exists in
|
|
7
|
+
* helm secrets verify <key> Confirm key exists in encrypted storage
|
|
8
8
|
* helm secrets delete <key> Remove with confirmation prompt
|
|
9
9
|
*
|
|
10
10
|
* Secret values are never printed, logged, or included in error messages.
|
|
@@ -26,11 +26,11 @@ import { theme, symbol } from "../ui/theme.js";
|
|
|
26
26
|
export function registerSecretsCommand(program) {
|
|
27
27
|
const secrets = program
|
|
28
28
|
.command("secrets")
|
|
29
|
-
.description("Manage
|
|
29
|
+
.description("Manage encrypted local storage credentials");
|
|
30
30
|
// ── set ────────────────────────────────────────────────────────────────────
|
|
31
31
|
secrets
|
|
32
32
|
.command("set <key>")
|
|
33
|
-
.description("Store a secret in the
|
|
33
|
+
.description("Store a secret in the encrypted local storage (masked input)")
|
|
34
34
|
.action(async (key) => {
|
|
35
35
|
requireSetup();
|
|
36
36
|
const { active_user: username } = getLocalConfig();
|
|
@@ -44,7 +44,7 @@ export function registerSecretsCommand(program) {
|
|
|
44
44
|
},
|
|
45
45
|
]);
|
|
46
46
|
await setSecret(username, key, value);
|
|
47
|
-
console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" stored in
|
|
47
|
+
console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" stored in encrypted local storage.`);
|
|
48
48
|
});
|
|
49
49
|
// ── list ───────────────────────────────────────────────────────────────────
|
|
50
50
|
secrets
|
|
@@ -67,22 +67,22 @@ export function registerSecretsCommand(program) {
|
|
|
67
67
|
// ── verify ─────────────────────────────────────────────────────────────────
|
|
68
68
|
secrets
|
|
69
69
|
.command("verify <key>")
|
|
70
|
-
.description("Confirm a secret key exists in the
|
|
70
|
+
.description("Confirm a secret key exists in the encrypted local storage")
|
|
71
71
|
.action(async (key) => {
|
|
72
72
|
requireSetup();
|
|
73
73
|
const { active_user: username } = getLocalConfig();
|
|
74
74
|
const exists = await verifySecret(username, key);
|
|
75
75
|
if (exists) {
|
|
76
|
-
console.log(` ${chalk.hex(theme.success)(symbol.success)} "${key}" exists in the
|
|
76
|
+
console.log(` ${chalk.hex(theme.success)(symbol.success)} "${key}" exists in the encrypted local storage.`);
|
|
77
77
|
}
|
|
78
78
|
else {
|
|
79
|
-
throw new HelmError(`Secret "${key}" was not found in the
|
|
79
|
+
throw new HelmError(`Secret "${key}" was not found in the encrypted local storage.`, `Run: helm secrets set ${key}`);
|
|
80
80
|
}
|
|
81
81
|
});
|
|
82
82
|
// ── delete ─────────────────────────────────────────────────────────────────
|
|
83
83
|
secrets
|
|
84
84
|
.command("delete <key>")
|
|
85
|
-
.description("Remove a secret from the
|
|
85
|
+
.description("Remove a secret from the encrypted local storage")
|
|
86
86
|
.action(async (key) => {
|
|
87
87
|
requireSetup();
|
|
88
88
|
const { active_user: username } = getLocalConfig();
|
|
@@ -90,7 +90,7 @@ export function registerSecretsCommand(program) {
|
|
|
90
90
|
{
|
|
91
91
|
type: "confirm",
|
|
92
92
|
name: "confirmed",
|
|
93
|
-
message: ` Delete secret "${key}" from the
|
|
93
|
+
message: ` Delete secret "${key}" from the encrypted local storage?`,
|
|
94
94
|
default: false,
|
|
95
95
|
},
|
|
96
96
|
]);
|
|
@@ -100,10 +100,10 @@ export function registerSecretsCommand(program) {
|
|
|
100
100
|
}
|
|
101
101
|
const deleted = await deleteSecret(username, key);
|
|
102
102
|
if (deleted) {
|
|
103
|
-
console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" deleted from
|
|
103
|
+
console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" deleted from encrypted local storage.`);
|
|
104
104
|
}
|
|
105
105
|
else {
|
|
106
|
-
throw new HelmError(`Secret "${key}" was not found in the
|
|
106
|
+
throw new HelmError(`Secret "${key}" was not found in the encrypted local storage.`, `Run: helm secrets list to see what keys are stored.`);
|
|
107
107
|
}
|
|
108
108
|
});
|
|
109
109
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,
|
|
1
|
+
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAEnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAoB;YACzD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,KAAK,GAAG,GAAG;gBACpB,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CACtB,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,wBAAwB;aAClD;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEtC,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,sCAAsC,CACpG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,GAAG,EAAE;QACX,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CACpB,2BAA2B,QAAQ,uCAAuC,CAC3E,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,4BAA4B,CAAC,EAAE,CAClI,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,0CAA0C,CACjG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CACjB,WAAW,GAAG,iDAAiD,EAC/D,yBAAyB,GAAG,EAAE,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAEnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAyB;YAClE;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oBAAoB,GAAG,qCAAqC;gBACrE,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAElD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,yCAAyC,CACvG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CACjB,WAAW,GAAG,iDAAiD,EAC/D,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
|
package/dist/commands/setup.js
CHANGED
|
@@ -187,14 +187,14 @@ async function step2CreateUserIdentity(repoRoot) {
|
|
|
187
187
|
/**
|
|
188
188
|
* For each input in inputs.yaml, asks whether to enable it. For enabled
|
|
189
189
|
* inputs, collects all required credentials via masked prompts, stores
|
|
190
|
-
* them in the
|
|
190
|
+
* them in the encrypted local storage, and runs a connectivity test.
|
|
191
191
|
*
|
|
192
192
|
* Updates the `enabled` and `configured` fields in inputs.yaml after
|
|
193
193
|
* each input is processed. This ensures partial progress is persisted
|
|
194
194
|
* even if the wizard is interrupted.
|
|
195
195
|
*
|
|
196
196
|
* @param repoRoot - Absolute path to the instance repo.
|
|
197
|
-
* @param username - Active username for
|
|
197
|
+
* @param username - Active username for secret scoping.
|
|
198
198
|
*/
|
|
199
199
|
async function step3ConnectInputs(repoRoot, username) {
|
|
200
200
|
printStep(3, "Connect inputs");
|
package/dist/core/inputs.d.ts
CHANGED
|
@@ -12,13 +12,13 @@
|
|
|
12
12
|
* and instructs the user to refresh it via helm secrets set. No silent
|
|
13
13
|
* token refresh is attempted in Phase 1 — that is Phase 2 scope.
|
|
14
14
|
*
|
|
15
|
-
* Secret values retrieved from
|
|
15
|
+
* Secret values retrieved from encrypted local storage are used directly in HTTP
|
|
16
16
|
* Authorization headers and are never included in any log output or
|
|
17
17
|
* error message.
|
|
18
18
|
*/
|
|
19
19
|
import type { InputTestResult } from "../types/index.js";
|
|
20
20
|
/**
|
|
21
|
-
* Ordered list of
|
|
21
|
+
* Ordered list of secret key names required by each input.
|
|
22
22
|
* Used during helm setup to prompt for each credential and during
|
|
23
23
|
* helm inputs test to retrieve them for connectivity checks.
|
|
24
24
|
*
|
package/dist/core/inputs.js
CHANGED
|
@@ -12,14 +12,14 @@
|
|
|
12
12
|
* and instructs the user to refresh it via helm secrets set. No silent
|
|
13
13
|
* token refresh is attempted in Phase 1 — that is Phase 2 scope.
|
|
14
14
|
*
|
|
15
|
-
* Secret values retrieved from
|
|
15
|
+
* Secret values retrieved from encrypted local storage are used directly in HTTP
|
|
16
16
|
* Authorization headers and are never included in any log output or
|
|
17
17
|
* error message.
|
|
18
18
|
*/
|
|
19
19
|
import { getSecret } from "./secrets.js";
|
|
20
20
|
// ─── Credential Key Definitions ───────────────────────────────────────────────
|
|
21
21
|
/**
|
|
22
|
-
* Ordered list of
|
|
22
|
+
* Ordered list of secret key names required by each input.
|
|
23
23
|
* Used during helm setup to prompt for each credential and during
|
|
24
24
|
* helm inputs test to retrieve them for connectivity checks.
|
|
25
25
|
*
|
package/dist/core/repo.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAiDrD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,mBAIrB,CAAC;AAIH;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAIrE;AAID;;;;;;;;GAQG;AACH,wBAAgB,YAAY,IAAI,IAAI,CASnC;AAID;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAGtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKxD"}
|
package/dist/core/repo.js
CHANGED
package/dist/core/repo.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,OAAO;IACP,cAAc;IACd,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;CACH,CAAC;AAEX;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC5B,aAAa;IACb,aAAa;IACb,YAAY;IACZ,eAAe;CACP,CAAC;AAEX,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,qBAAqB,GAAgB;IACzC,kBAAkB,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE;IACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;IACvC,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,EAAE;
|
|
1
|
+
{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,OAAO;IACP,cAAc;IACd,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;CACH,CAAC;AAEX;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC5B,aAAa;IACb,aAAa;IACb,YAAY;IACZ,eAAe;CACP,CAAC;AAEX,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,qBAAqB,GAAgB;IACzC,kBAAkB,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE;IACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;IACvC,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAc;IAC9C,WAAW,EAAE,OAAO;IACpB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;IACtC,QAAQ,EAAE,qBAAqB;CAChC,CAAC,CAAC;AAEH,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,KAAoB,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAA0D,EAAE,CAAC;QAC5G,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CACjB,2CAA2C,EAC3C,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAG,QAAkB;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAW,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
package/dist/core/secrets.d.ts
CHANGED
|
@@ -1,39 +1,42 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @file
|
|
2
|
+
* @file Encrypted local secret storage for HELM.
|
|
3
3
|
*
|
|
4
4
|
* All secret storage and retrieval is routed through this module.
|
|
5
5
|
* Secret values are handled as transiently as possible:
|
|
6
6
|
*
|
|
7
|
-
* - Values are never written to any file, log, or error message.
|
|
7
|
+
* - Values are never written to any file, log, or error message in plaintext.
|
|
8
8
|
* - The only moment a value appears in memory outside this module is
|
|
9
9
|
* during the masked inquirer prompt in the setup wizard and
|
|
10
10
|
* helm secrets set — immediately passed to setSecret() and discarded.
|
|
11
11
|
* - listSecretKeys() returns key names only. Values are never returned
|
|
12
12
|
* to callers that don't explicitly call getSecret().
|
|
13
13
|
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
14
|
+
* Secrets are encrypted with AES-256-GCM using a key derived via PBKDF2
|
|
15
|
+
* from machine-specific entropy (hostname + OS username). Encrypted values
|
|
16
|
+
* are stored in the local conf store at ~/.chief/config.json under the
|
|
17
|
+
* `encrypted_secrets` key. A manifest of key names (not values) is stored
|
|
18
|
+
* separately under `secrets_manifest` for enumeration.
|
|
18
19
|
*
|
|
19
|
-
*
|
|
20
|
-
*
|
|
20
|
+
* Encrypted value format: "iv:authTag:ciphertext" (all hex-encoded).
|
|
21
|
+
*
|
|
22
|
+
* Account format in manifest: "[username]/[KEY_NAME]"
|
|
21
23
|
*/
|
|
22
24
|
/**
|
|
23
|
-
*
|
|
24
|
-
* in the
|
|
25
|
+
* Encrypts and stores a secret value in the local conf store, and records
|
|
26
|
+
* the key name in the manifest.
|
|
25
27
|
*
|
|
26
|
-
* The value is
|
|
27
|
-
*
|
|
28
|
+
* The value is encrypted immediately upon receipt and discarded from
|
|
29
|
+
* this function's scope. Callers must not retain the value after this
|
|
30
|
+
* call returns.
|
|
28
31
|
*
|
|
29
32
|
* @param username - Active username (used as the account prefix).
|
|
30
|
-
* @param key
|
|
31
|
-
* @param value
|
|
32
|
-
* @throws {HelmError} If
|
|
33
|
+
* @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
|
|
34
|
+
* @param value - The secret value. Never logged or stored in plaintext.
|
|
35
|
+
* @throws {HelmError} If encryption fails.
|
|
33
36
|
*/
|
|
34
37
|
export declare function setSecret(username: string, key: string, value: string): Promise<void>;
|
|
35
38
|
/**
|
|
36
|
-
* Retrieves a secret value from the
|
|
39
|
+
* Retrieves and decrypts a secret value from the local conf store.
|
|
37
40
|
*
|
|
38
41
|
* Returns null if the key does not exist. Callers must handle the null
|
|
39
42
|
* case by throwing an appropriate HelmError naming the missing key and
|
|
@@ -43,37 +46,38 @@ export declare function setSecret(username: string, key: string, value: string):
|
|
|
43
46
|
* user-facing string.
|
|
44
47
|
*
|
|
45
48
|
* @param username - Active username.
|
|
46
|
-
* @param key
|
|
47
|
-
* @
|
|
49
|
+
* @param key - Secret key name to retrieve.
|
|
50
|
+
* @returns The decrypted secret value, or null if not found.
|
|
51
|
+
* @throws {HelmError} If decryption fails.
|
|
48
52
|
*/
|
|
49
53
|
export declare function getSecret(username: string, key: string): Promise<string | null>;
|
|
50
54
|
/**
|
|
51
55
|
* Returns the list of secret key names stored for the given username.
|
|
52
56
|
* Values are never returned — only names.
|
|
53
57
|
*
|
|
54
|
-
* Reads from the local manifest rather than
|
|
55
|
-
* directly, because the keychain API does not support enumeration.
|
|
58
|
+
* Reads from the local manifest rather than iterating encrypted entries.
|
|
56
59
|
*
|
|
57
60
|
* @param username - Active username to filter by.
|
|
61
|
+
* @returns Sorted array of key names (without the username prefix).
|
|
58
62
|
*/
|
|
59
63
|
export declare function listSecretKeys(username: string): string[];
|
|
60
64
|
/**
|
|
61
65
|
* Returns true if a secret with the given key name exists in the
|
|
62
|
-
*
|
|
66
|
+
* local conf store for the given username.
|
|
63
67
|
*
|
|
64
68
|
* @param username - Active username.
|
|
65
|
-
* @param key
|
|
66
|
-
* @
|
|
69
|
+
* @param key - Secret key name to check.
|
|
70
|
+
* @returns True if the secret exists and can be decrypted.
|
|
71
|
+
* @throws {HelmError} If decryption fails.
|
|
67
72
|
*/
|
|
68
73
|
export declare function verifySecret(username: string, key: string): Promise<boolean>;
|
|
69
74
|
/**
|
|
70
|
-
* Removes
|
|
71
|
-
*
|
|
75
|
+
* Removes an encrypted secret from the local conf store and removes its
|
|
76
|
+
* name from the manifest.
|
|
72
77
|
*
|
|
73
78
|
* @param username - Active username.
|
|
74
|
-
* @param key
|
|
79
|
+
* @param key - Secret key name to delete.
|
|
75
80
|
* @returns True if the key existed and was deleted; false if it did not exist.
|
|
76
|
-
* @throws {HelmError} If the keychain deletion fails.
|
|
77
81
|
*/
|
|
78
82
|
export declare function deleteSecret(username: string, key: string): Promise<boolean>;
|
|
79
83
|
//# sourceMappingURL=secrets.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA6IH;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAalB"}
|
package/dist/core/secrets.js
CHANGED
|
@@ -1,52 +1,112 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @file
|
|
2
|
+
* @file Encrypted local secret storage for HELM.
|
|
3
3
|
*
|
|
4
4
|
* All secret storage and retrieval is routed through this module.
|
|
5
5
|
* Secret values are handled as transiently as possible:
|
|
6
6
|
*
|
|
7
|
-
* - Values are never written to any file, log, or error message.
|
|
7
|
+
* - Values are never written to any file, log, or error message in plaintext.
|
|
8
8
|
* - The only moment a value appears in memory outside this module is
|
|
9
9
|
* during the masked inquirer prompt in the setup wizard and
|
|
10
10
|
* helm secrets set — immediately passed to setSecret() and discarded.
|
|
11
11
|
* - listSecretKeys() returns key names only. Values are never returned
|
|
12
12
|
* to callers that don't explicitly call getSecret().
|
|
13
13
|
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
14
|
+
* Secrets are encrypted with AES-256-GCM using a key derived via PBKDF2
|
|
15
|
+
* from machine-specific entropy (hostname + OS username). Encrypted values
|
|
16
|
+
* are stored in the local conf store at ~/.chief/config.json under the
|
|
17
|
+
* `encrypted_secrets` key. A manifest of key names (not values) is stored
|
|
18
|
+
* separately under `secrets_manifest` for enumeration.
|
|
18
19
|
*
|
|
19
|
-
*
|
|
20
|
-
*
|
|
20
|
+
* Encrypted value format: "iv:authTag:ciphertext" (all hex-encoded).
|
|
21
|
+
*
|
|
22
|
+
* Account format in manifest: "[username]/[KEY_NAME]"
|
|
21
23
|
*/
|
|
22
|
-
import
|
|
23
|
-
import
|
|
24
|
+
import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv } from "node:crypto";
|
|
25
|
+
import os from "node:os";
|
|
24
26
|
import { localStore } from "./repo.js";
|
|
25
27
|
import { HelmError } from "../utils/errors.js";
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
28
|
+
// ─── Encryption Constants ─────────────────────────────────────────────────────
|
|
29
|
+
/** AES-256-GCM cipher algorithm identifier. */
|
|
30
|
+
const CIPHER_ALGORITHM = "aes-256-gcm";
|
|
31
|
+
/** Length in bytes of the initialisation vector for AES-GCM. */
|
|
32
|
+
const IV_LENGTH = 16;
|
|
33
|
+
/** Length in bytes of the GCM authentication tag. */
|
|
34
|
+
const AUTH_TAG_LENGTH = 16;
|
|
35
|
+
/** Length in bytes of the derived encryption key (256 bits for AES-256). */
|
|
36
|
+
const KEY_LENGTH = 32;
|
|
37
|
+
/** PBKDF2 iteration count. OWASP recommends >= 600,000 for SHA-256. */
|
|
38
|
+
const PBKDF2_ITERATIONS = 600_000;
|
|
39
|
+
/** PBKDF2 digest algorithm. */
|
|
40
|
+
const PBKDF2_DIGEST = "sha256";
|
|
41
|
+
/**
|
|
42
|
+
* Static salt prefix combined with machine-specific entropy.
|
|
43
|
+
* Changing this value invalidates all previously encrypted secrets.
|
|
44
|
+
*/
|
|
45
|
+
const SALT_PREFIX = "chief-helm-secrets";
|
|
46
|
+
// ─── Key Derivation ───────────────────────────────────────────────────────────
|
|
47
|
+
/**
|
|
48
|
+
* Derives a 256-bit encryption key from machine-specific entropy using PBKDF2.
|
|
49
|
+
*
|
|
50
|
+
* The derivation input combines a static salt prefix with the machine's
|
|
51
|
+
* hostname and OS-level username. This ties encrypted secrets to the
|
|
52
|
+
* specific machine and OS user account, preventing portability of the
|
|
53
|
+
* encrypted config file to a different machine without re-entering secrets.
|
|
54
|
+
*
|
|
55
|
+
* @returns A 32-byte Buffer suitable for use as an AES-256 key.
|
|
56
|
+
*/
|
|
57
|
+
function deriveEncryptionKey() {
|
|
58
|
+
const machineEntropy = `${SALT_PREFIX}:${os.hostname()}:${os.userInfo().username}`;
|
|
59
|
+
return pbkdf2Sync(machineEntropy, SALT_PREFIX, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);
|
|
60
|
+
}
|
|
61
|
+
// ─── Encrypt / Decrypt ────────────────────────────────────────────────────────
|
|
29
62
|
/**
|
|
30
|
-
*
|
|
31
|
-
*
|
|
63
|
+
* Encrypts a plaintext string using AES-256-GCM.
|
|
64
|
+
*
|
|
65
|
+
* @param plaintext - The secret value to encrypt.
|
|
66
|
+
* @returns A colon-delimited string: "iv:authTag:ciphertext" (all hex-encoded).
|
|
32
67
|
*/
|
|
33
|
-
|
|
68
|
+
function encrypt(plaintext) {
|
|
69
|
+
const key = deriveEncryptionKey();
|
|
70
|
+
const iv = randomBytes(IV_LENGTH);
|
|
71
|
+
const cipher = createCipheriv(CIPHER_ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
|
|
72
|
+
const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
|
|
73
|
+
const authTag = cipher.getAuthTag();
|
|
74
|
+
return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
|
|
75
|
+
}
|
|
34
76
|
/**
|
|
35
|
-
*
|
|
36
|
-
*
|
|
37
|
-
*
|
|
38
|
-
*
|
|
77
|
+
* Decrypts a value previously encrypted by {@link encrypt}.
|
|
78
|
+
*
|
|
79
|
+
* @param encryptedValue - Colon-delimited string: "iv:authTag:ciphertext" (hex-encoded).
|
|
80
|
+
* @returns The original plaintext string.
|
|
81
|
+
* @throws {HelmError} If the encrypted value format is invalid or decryption fails.
|
|
39
82
|
*/
|
|
40
|
-
function
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
83
|
+
function decrypt(encryptedValue) {
|
|
84
|
+
const parts = encryptedValue.split(":");
|
|
85
|
+
if (parts.length !== 3) {
|
|
86
|
+
throw new HelmError("Encrypted secret has an invalid format.", "Re-store the secret with: helm secrets set <KEY>");
|
|
87
|
+
}
|
|
88
|
+
const [ivHex, authTagHex, ciphertextHex] = parts;
|
|
89
|
+
const key = deriveEncryptionKey();
|
|
90
|
+
const iv = Buffer.from(ivHex, "hex");
|
|
91
|
+
const authTag = Buffer.from(authTagHex, "hex");
|
|
92
|
+
const ciphertext = Buffer.from(ciphertextHex, "hex");
|
|
93
|
+
const decipher = createDecipheriv(CIPHER_ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
|
|
94
|
+
decipher.setAuthTag(authTag);
|
|
95
|
+
try {
|
|
96
|
+
const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
|
|
97
|
+
return decrypted.toString("utf8");
|
|
98
|
+
}
|
|
99
|
+
catch {
|
|
100
|
+
throw new HelmError("Failed to decrypt secret. The encryption key may have changed (hostname or OS user changed).", "Re-store the secret with: helm secrets set <KEY>");
|
|
44
101
|
}
|
|
45
102
|
}
|
|
46
103
|
// ─── Manifest Helpers ─────────────────────────────────────────────────────────
|
|
47
104
|
/**
|
|
48
105
|
* Adds a fully-qualified key name ("[username]/[KEY_NAME]") to the
|
|
49
106
|
* manifest in local config if it is not already present.
|
|
107
|
+
*
|
|
108
|
+
* @param username - Active username.
|
|
109
|
+
* @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
|
|
50
110
|
*/
|
|
51
111
|
function addToManifest(username, key) {
|
|
52
112
|
const fullKey = `${username}/${key}`;
|
|
@@ -58,6 +118,9 @@ function addToManifest(username, key) {
|
|
|
58
118
|
/**
|
|
59
119
|
* Removes a fully-qualified key name from the manifest in local config.
|
|
60
120
|
* No-op if the key is not present.
|
|
121
|
+
*
|
|
122
|
+
* @param username - Active username.
|
|
123
|
+
* @param key - Secret key name to remove.
|
|
61
124
|
*/
|
|
62
125
|
function removeFromManifest(username, key) {
|
|
63
126
|
const fullKey = `${username}/${key}`;
|
|
@@ -66,30 +129,36 @@ function removeFromManifest(username, key) {
|
|
|
66
129
|
}
|
|
67
130
|
// ─── Public API ───────────────────────────────────────────────────────────────
|
|
68
131
|
/**
|
|
69
|
-
*
|
|
70
|
-
* in the
|
|
132
|
+
* Encrypts and stores a secret value in the local conf store, and records
|
|
133
|
+
* the key name in the manifest.
|
|
71
134
|
*
|
|
72
|
-
* The value is
|
|
73
|
-
*
|
|
135
|
+
* The value is encrypted immediately upon receipt and discarded from
|
|
136
|
+
* this function's scope. Callers must not retain the value after this
|
|
137
|
+
* call returns.
|
|
74
138
|
*
|
|
75
139
|
* @param username - Active username (used as the account prefix).
|
|
76
|
-
* @param key
|
|
77
|
-
* @param value
|
|
78
|
-
* @throws {HelmError} If
|
|
140
|
+
* @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
|
|
141
|
+
* @param value - The secret value. Never logged or stored in plaintext.
|
|
142
|
+
* @throws {HelmError} If encryption fails.
|
|
79
143
|
*/
|
|
80
144
|
export async function setSecret(username, key, value) {
|
|
81
|
-
|
|
145
|
+
const fullKey = `${username}/${key}`;
|
|
82
146
|
try {
|
|
83
|
-
|
|
147
|
+
const encryptedValue = encrypt(value);
|
|
148
|
+
const secrets = localStore.get("encrypted_secrets") ?? {};
|
|
149
|
+
secrets[fullKey] = encryptedValue;
|
|
150
|
+
localStore.set("encrypted_secrets", secrets);
|
|
84
151
|
}
|
|
85
152
|
catch (err) {
|
|
153
|
+
if (err instanceof HelmError)
|
|
154
|
+
throw err;
|
|
86
155
|
const detail = err instanceof Error ? err.message : String(err);
|
|
87
|
-
throw new HelmError(`Failed to store secret "${key}"
|
|
156
|
+
throw new HelmError(`Failed to encrypt and store secret "${key}": ${detail}`, "Ensure your system supports AES-256-GCM and try again.");
|
|
88
157
|
}
|
|
89
158
|
addToManifest(username, key);
|
|
90
159
|
}
|
|
91
160
|
/**
|
|
92
|
-
* Retrieves a secret value from the
|
|
161
|
+
* Retrieves and decrypts a secret value from the local conf store.
|
|
93
162
|
*
|
|
94
163
|
* Returns null if the key does not exist. Callers must handle the null
|
|
95
164
|
* case by throwing an appropriate HelmError naming the missing key and
|
|
@@ -99,27 +168,35 @@ export async function setSecret(username, key, value) {
|
|
|
99
168
|
* user-facing string.
|
|
100
169
|
*
|
|
101
170
|
* @param username - Active username.
|
|
102
|
-
* @param key
|
|
103
|
-
* @
|
|
171
|
+
* @param key - Secret key name to retrieve.
|
|
172
|
+
* @returns The decrypted secret value, or null if not found.
|
|
173
|
+
* @throws {HelmError} If decryption fails.
|
|
104
174
|
*/
|
|
105
175
|
export async function getSecret(username, key) {
|
|
106
|
-
|
|
176
|
+
const fullKey = `${username}/${key}`;
|
|
177
|
+
const secrets = localStore.get("encrypted_secrets") ?? {};
|
|
178
|
+
const encryptedValue = secrets[fullKey];
|
|
179
|
+
if (encryptedValue === undefined) {
|
|
180
|
+
return null;
|
|
181
|
+
}
|
|
107
182
|
try {
|
|
108
|
-
return
|
|
183
|
+
return decrypt(encryptedValue);
|
|
109
184
|
}
|
|
110
185
|
catch (err) {
|
|
186
|
+
if (err instanceof HelmError)
|
|
187
|
+
throw err;
|
|
111
188
|
const detail = err instanceof Error ? err.message : String(err);
|
|
112
|
-
throw new HelmError(`Failed to
|
|
189
|
+
throw new HelmError(`Failed to decrypt secret "${key}": ${detail}`, "Re-store the secret with: helm secrets set " + key);
|
|
113
190
|
}
|
|
114
191
|
}
|
|
115
192
|
/**
|
|
116
193
|
* Returns the list of secret key names stored for the given username.
|
|
117
194
|
* Values are never returned — only names.
|
|
118
195
|
*
|
|
119
|
-
* Reads from the local manifest rather than
|
|
120
|
-
* directly, because the keychain API does not support enumeration.
|
|
196
|
+
* Reads from the local manifest rather than iterating encrypted entries.
|
|
121
197
|
*
|
|
122
198
|
* @param username - Active username to filter by.
|
|
199
|
+
* @returns Sorted array of key names (without the username prefix).
|
|
123
200
|
*/
|
|
124
201
|
export function listSecretKeys(username) {
|
|
125
202
|
const manifest = localStore.get("secrets_manifest") ?? [];
|
|
@@ -131,38 +208,34 @@ export function listSecretKeys(username) {
|
|
|
131
208
|
}
|
|
132
209
|
/**
|
|
133
210
|
* Returns true if a secret with the given key name exists in the
|
|
134
|
-
*
|
|
211
|
+
* local conf store for the given username.
|
|
135
212
|
*
|
|
136
213
|
* @param username - Active username.
|
|
137
|
-
* @param key
|
|
138
|
-
* @
|
|
214
|
+
* @param key - Secret key name to check.
|
|
215
|
+
* @returns True if the secret exists and can be decrypted.
|
|
216
|
+
* @throws {HelmError} If decryption fails.
|
|
139
217
|
*/
|
|
140
218
|
export async function verifySecret(username, key) {
|
|
141
219
|
const value = await getSecret(username, key);
|
|
142
220
|
return value !== null;
|
|
143
221
|
}
|
|
144
222
|
/**
|
|
145
|
-
* Removes
|
|
146
|
-
*
|
|
223
|
+
* Removes an encrypted secret from the local conf store and removes its
|
|
224
|
+
* name from the manifest.
|
|
147
225
|
*
|
|
148
226
|
* @param username - Active username.
|
|
149
|
-
* @param key
|
|
227
|
+
* @param key - Secret key name to delete.
|
|
150
228
|
* @returns True if the key existed and was deleted; false if it did not exist.
|
|
151
|
-
* @throws {HelmError} If the keychain deletion fails.
|
|
152
229
|
*/
|
|
153
230
|
export async function deleteSecret(username, key) {
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
}
|
|
159
|
-
catch (err) {
|
|
160
|
-
const detail = err instanceof Error ? err.message : String(err);
|
|
161
|
-
throw new HelmError(`Failed to delete secret "${key}" from the OS keychain: ${detail}`, "Ensure your OS keychain is accessible and try again.");
|
|
162
|
-
}
|
|
163
|
-
if (deleted) {
|
|
164
|
-
removeFromManifest(username, key);
|
|
231
|
+
const fullKey = `${username}/${key}`;
|
|
232
|
+
const secrets = localStore.get("encrypted_secrets") ?? {};
|
|
233
|
+
if (secrets[fullKey] === undefined) {
|
|
234
|
+
return false;
|
|
165
235
|
}
|
|
166
|
-
|
|
236
|
+
delete secrets[fullKey];
|
|
237
|
+
localStore.set("encrypted_secrets", secrets);
|
|
238
|
+
removeFromManifest(username, key);
|
|
239
|
+
return true;
|
|
167
240
|
}
|
|
168
241
|
//# sourceMappingURL=secrets.js.map
|
package/dist/core/secrets.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,iFAAiF;AAEjF,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD,gEAAgE;AAChE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qDAAqD;AACrD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,4EAA4E;AAC5E,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,+BAA+B;AAC/B,MAAM,aAAa,GAAG,QAAiB,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,GAAG,oBAA6B,CAAC;AAElD,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,MAAM,cAAc,GAAG,GAAG,WAAW,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IACnF,OAAO,UAAU,CAAC,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAC/F,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,SAAS,OAAO,CAAC,SAAiB;IAChC,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAE7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,cAAsB;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,yCAAyC,EACzC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IAC7E,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CACjB,8FAA8F,EAC9F,kDAAkD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IAExE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,GAAW;IACvD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IACxE,UAAU,CAAC,GAAG,CACZ,kBAAkB,EAClB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,GAAW,EACX,KAAa;IAEb,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAA4B,IAAI,EAAE,CAAC;QACtF,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC;QAClC,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,uCAAuC,GAAG,MAAM,MAAM,EAAE,EACxD,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,GAAW;IAEX,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,OAAO,GAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAA4B,IAAI,EAAE,CAAC;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,6BAA6B,GAAG,MAAM,MAAM,EAAE,EAC9C,6CAA6C,GAAG,GAAG,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAE9B,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAClC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAW;IAEX,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,OAAO,GAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAA4B,IAAI,EAAE,CAAC;IAEtF,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAElC,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/types/index.d.ts
CHANGED
|
@@ -155,11 +155,16 @@ export interface LocalConfig {
|
|
|
155
155
|
/** ISO 8601 timestamp of the last successful helm sync. */
|
|
156
156
|
last_sync: string;
|
|
157
157
|
/**
|
|
158
|
-
* List of secret key names stored
|
|
158
|
+
* List of secret key names stored on this machine.
|
|
159
159
|
* Format: "[username]/[KEY_NAME]". Values are never stored here — only names.
|
|
160
|
-
* This manifest exists because the OS keychain API does not support enumeration.
|
|
161
160
|
*/
|
|
162
161
|
secrets_manifest: string[];
|
|
162
|
+
/**
|
|
163
|
+
* AES-256-GCM encrypted secret values keyed by "[username]/[KEY_NAME]".
|
|
164
|
+
* Each value is a colon-delimited string: "iv:authTag:ciphertext" (all hex-encoded).
|
|
165
|
+
* Decrypted at runtime using a PBKDF2-derived key from machine-specific entropy.
|
|
166
|
+
*/
|
|
167
|
+
encrypted_secrets: Record<string, string>;
|
|
163
168
|
}
|
|
164
169
|
/**
|
|
165
170
|
* A single flow's last execution record.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,wBAAwB,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC/B,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,MAAM,EAAE,aAAa,GAAG,eAAe,CAAC;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,wBAAwB,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC/B,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,MAAM,EAAE,aAAa,GAAG,eAAe,CAAC;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAID;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAIzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "chief-helm",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.3",
|
|
4
4
|
"description": "CLI for CHIEF — Personal AI Operations System",
|
|
5
|
+
"repository": {
|
|
6
|
+
"type": "git",
|
|
7
|
+
"url": "https://github.com/joselvelez/CHIEF.git",
|
|
8
|
+
"directory": "helm"
|
|
9
|
+
},
|
|
5
10
|
"type": "module",
|
|
6
11
|
"bin": {
|
|
7
12
|
"helm": "./dist/index.js"
|
|
@@ -35,7 +40,6 @@
|
|
|
35
40
|
"ink": "^5.1.4",
|
|
36
41
|
"inquirer": "^13.3.0",
|
|
37
42
|
"js-yaml": "^4.1.0",
|
|
38
|
-
"keytar": "^7.9.0",
|
|
39
43
|
"open": "^10.1.0",
|
|
40
44
|
"ora": "^8.0.1",
|
|
41
45
|
"react": "^18.3.1",
|