credkeep 0.1.0

package/dist/credentials.js

@@ -0,0 +1,252 @@
+/**
+ * What it takes to sign in to a site, by site name (`github`, or
+ * `google@ops` for a second account). Stored outside any repo or journal:
+ * a sealed 0600 JSON file on a laptop, env entries in a container. Read at
+ * the moment a login needs it, never carried on a plan or in a memo.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname } from "node:path";
+import { z } from "zod";
+import { isSealed, plainCipher } from "./cipher.js";
+const expandHome = (p) => (p.startsWith("~/") ? `${homedir()}${p.slice(1)}` : p);
+export const credentialSchema = z
+    .object({
+    username: z.string().min(1),
+    /** Absent when the account has none: it signs in through a provider (`via`). */
+    password: z.string().min(1).optional(),
+    /** The password before the last rotation: tried once when the site rejects the current one. */
+    previousPassword: z.string().min(1).optional(),
+    /** Base32 TOTP seed (the site's "manual entry key", spaces and dashes allowed); never a 6-digit code. */
+    totpSecret: z
+        .string()
+        .transform((s) => s.replace(/[\s=-]/g, "").toUpperCase())
+        .pipe(z
+        .string()
+        .regex(/^[A-Z2-7]{16,}$/, "totpSecret must be the base32 seed (16+ letters/digits), not a 6-digit code"))
+        .optional(),
+    /** One-time recovery codes the site handed out; used, then dropped. */
+    recoveryCodes: z.array(z.string().min(1)).default([]),
+    /** Where the site sends email codes; defaults to `username` when that is an address. */
+    codesInbox: z.string().email().optional(),
+    /** Passkeys enrolled by us (the virtual authenticator's export); loaded into the site's browser session. */
+    passkeys: z
+        .array(z.object({
+        rpId: z.string(),
+        credentialId: z.string(),
+        privateKey: z.string(),
+        userHandle: z.string().optional(),
+        signCount: z.number(),
+        isResidentCredential: z.boolean(),
+    }))
+        .default([]),
+    /** Sign in through this identity provider's button (`google`) instead of a password; the provider's own credential does the work. */
+    via: z.string().min(1).optional(),
+    /**
+     * A tripwire, not an account: nothing legitimate ever reads it. A `get`
+     * of a canary is an alarm (see canary.ts), and its password belongs on
+     * no host.
+     */
+    canary: z.boolean().optional(),
+    /** Where the sign-in page is, when the caller knows no login page of its own for the site. */
+    url: z.string().url().optional(),
+    /** When the account was made; a minted credential without it is a signup still owed. */
+    madeAt: z.string().datetime().optional(),
+})
+    .refine((c) => c.password || c.via, { message: "a credential has a password or a via provider" });
+const fileSchema = z.object({ sites: z.record(z.string(), credentialSchema) });
+/**
+ * `{ "sites": { "<site>": Credential } }` at `path`, mode 0600, written
+ * atomically, sealed with `cipher` (a plain file written earlier is still
+ * read, and sealed on the next write).
+ */
+export function fileCredentials(path, cipher = plainCipher) {
+    const file = expandHome(path);
+    // Opened and parsed once per version of the file: a `list` + `get` per name is one read, and
+    // a file another process rewrote (its mtime or size moved) is read again. A stat per call.
+    let cached = null;
+    const read = () => {
+        if (!existsSync(file)) {
+            cached = null;
+            return { sites: {} };
+        }
+        const st = statSync(file);
+        const stamp = `${st.mtimeMs}:${st.size}`;
+        if (cached?.stamp === stamp)
+            return cached.data;
+        const raw = readFileSync(file, "utf8");
+        const data = fileSchema.parse(JSON.parse(isSealed(raw) ? cipher.open(raw) : raw));
+        cached = { stamp, data };
+        return data;
+    };
+    return {
+        async get(site) {
+            return read().sites[site] ?? null;
+        },
+        async put(site, cred) {
+            const data = { sites: { ...read().sites, [site]: credentialSchema.parse(cred) } };
+            mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+            const tmp = `${file}.tmp`;
+            writeFileSync(tmp, cipher.seal(JSON.stringify(data, null, 2)), { mode: 0o600 });
+            renameSync(tmp, file);
+            cached = null;
+        },
+        async list() {
+            return Object.keys(read().sites);
+        },
+    };
+}
+export function memoryCredentials(init = {}) {
+    const sites = new Map(Object.entries(init).map(([k, v]) => [k, credentialSchema.parse(v)]));
+    return {
+        async get(site) {
+            return sites.get(site) ?? null;
+        },
+        async put(site, cred) {
+            sites.set(site, credentialSchema.parse(cred));
+        },
+        async list() {
+            return [...sites.keys()];
+        },
+    };
+}
+const DEFAULT_PREFIX = "CRED_";
+/** `CRED_<SITE>_<FIELD>`: the env name a credential field travels under. */
+export function credentialEnvName(site, field, o = {}) {
+    return `${o.prefix ?? DEFAULT_PREFIX}${envSiteName(site)}_${field}`;
+}
+/** `google@ops` → `GOOGLE__OPS`, `google-admin` → `GOOGLE_ADMIN`: the account keeps its own mark so `list` can read it back. */
+const envSiteName = (site) => site
+    .replace(/@/g, "__")
+    .replace(/[^a-zA-Z0-9_]+/g, "_")
+    .toUpperCase();
+const USERNAME = "_USERNAME";
+const siteFromEnvName = (s) => s.toLowerCase().replace(/__/g, "@").replace(/_/g, "-");
+/**
+ * A credential as env entries, for the store the box reads: username,
+ * password, TOTP seed, via provider, codes inbox. Recovery codes and
+ * passkeys stay on the machine that holds the file.
+ */
+export function credentialEnv(site, cred, o = {}) {
+    const fields = [
+        ["USERNAME", cred.username],
+        ["PASSWORD", cred.password],
+        ["TOTP_SECRET", cred.totpSecret],
+        ["VIA", cred.via],
+        ["CODES_INBOX", cred.codesInbox],
+    ];
+    return fields
+        .filter((f) => Boolean(f[1]))
+        .map(([field, value]) => ({ name: credentialEnvName(site, field, o), value }));
+}
+/**
+ * `CRED_<SITE>_USERNAME` / `_PASSWORD` / `_TOTP_SECRET` / `_VIA` /
+ * `_CODES_INBOX`: the container form, where a Secret becomes env. Read-only.
+ */
+export function envCredentials(env = process.env, o = {}) {
+    const prefix = o.prefix ?? DEFAULT_PREFIX;
+    const key = (site, field) => credentialEnvName(site, field, o);
+    return {
+        async get(site) {
+            const username = env[key(site, "USERNAME")];
+            const password = env[key(site, "PASSWORD")];
+            const via = env[key(site, "VIA")];
+            if (!username || !(password || via))
+                return null;
+            const totpSecret = env[key(site, "TOTP_SECRET")];
+            const codesInbox = env[key(site, "CODES_INBOX")];
+            return credentialSchema.parse({
+                username,
+                ...(password ? { password } : {}),
+                ...(totpSecret ? { totpSecret } : {}),
+                ...(via ? { via } : {}),
+                ...(codesInbox ? { codesInbox } : {}),
+            });
+        },
+        async put(site) {
+            throw new Error(`credentials for ${site}: env store is read-only; set ${key(site, "*")}`);
+        },
+        async list() {
+            return Object.keys(env)
+                .map((k) => k.startsWith(prefix) && k.endsWith(USERNAME)
+                ? k.slice(prefix.length, -USERNAME.length)
+                : undefined)
+                .filter((s) => Boolean(s))
+                .map(siteFromEnvName);
+        },
+    };
+}
+/**
+ * This machine's credentials into the env store, every site or the named
+ * ones: username, password, TOTP seed, via, codes inbox. Canaries never
+ * travel (a tripwire belongs to one machine); passkeys and recovery codes
+ * cannot. Answers what was pushed, never a value.
+ */
+export async function pushCredentials(local, store, sites, o = {}) {
+    const chosen = sites?.length ? sites : await local.list();
+    const out = [];
+    for (const site of chosen) {
+        const cred = await local.get(site);
+        if (!cred)
+            throw new Error(`no credential stored here for ${site}`);
+        if (cred.canary)
+            continue;
+        const entries = credentialEnv(site, cred, o);
+        for (const e of entries)
+            await store.put(e.name, e.value);
+        out.push({ site, names: entries.map((e) => e.name) });
+    }
+    return out;
+}
+/**
+ * The env store's credentials into this machine's file, the other way: a
+ * second laptop, or a box's file for a passkey site. A site already here is
+ * kept unless `overwrite`, and even then its passkeys and recovery codes
+ * stay (env never carries them). Answers what was written and what was kept.
+ */
+export async function pullCredentials(store, local, sites, o = {}) {
+    const env = Object.fromEntries((await store.all()).map((e) => [e.name, e.value]));
+    const remote = envCredentials(env, o);
+    const chosen = sites?.length ? sites : await remote.list();
+    const written = [];
+    const kept = [];
+    for (const site of chosen) {
+        const cred = await remote.get(site);
+        if (!cred)
+            throw new Error(`no credential in the shared store for ${site}: push it first`);
+        const here = await local.get(site);
+        if (here && !o.overwrite) {
+            kept.push(site);
+            continue;
+        }
+        await local.put(site, {
+            ...cred,
+            recoveryCodes: here?.recoveryCodes ?? cred.recoveryCodes,
+            passkeys: here?.passkeys ?? cred.passkeys,
+        });
+        written.push(site);
+    }
+    return { written, kept };
+}
+/** First store that has the site wins; writes go to `write`, which defaults to the last store. */
+export function layeredCredentials(stores, write = stores.at(-1)) {
+    const first = write;
+    if (!first)
+        throw new Error("layeredCredentials needs at least one store");
+    return {
+        async get(site) {
+            for (const s of stores) {
+                const c = await s.get(site);
+                if (c)
+                    return c;
+            }
+            return null;
+        },
+        put: (site, cred) => first.put(site, cred),
+        async list() {
+            const all = await Promise.all(stores.map((s) => s.list()));
+            return [...new Set(all.flat())];
+        },
+    };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAe,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,+FAA+F;IAC/F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,yGAAyG;IACzG,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;SACxD,IAAI,CACH,CAAC;SACE,MAAM,EAAE;SACR,KAAK,CACJ,iBAAiB,EACjB,6EAA6E,CAC9E,CACJ;SACA,QAAQ,EAAE;IACb,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,wFAAwF;IACxF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACzC,4GAA4G;IAC5G,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;KAClC,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,qIAAqI;IACrI,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,8FAA8F;IAC9F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,wFAAwF;IACxF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;AAYpG,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB,WAAW;IACxE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE9B,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,MAAM,GAAyC,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,MAAM,EAAE,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,OAAO,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI;YAClB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClF,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;YAC1B,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAwC,EAAE;IAC1E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI;YAClB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa,EAAE,IAAe,EAAE;IAC9E,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;AACtE,CAAC;AAED,gIAAgI;AAChI,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAC3C,IAAI;KACD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;KACnB,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;KAC/B,WAAW,EAAE,CAAC;AACnB,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,eAAe,GAAG,CAAC,CAAS,EAAU,EAAE,CAC5C,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,IAAgB,EAChB,IAAe,EAAE;IAEjB,MAAM,MAAM,GAAmC;QAC7C,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;QAChC,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;QACjB,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;KACjC,CAAC;IACF,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAyB,OAAO,CAAC,GAAG,EACpC,IAAe,EAAE;IAEjB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YACjD,OAAO,gBAAgB,CAAC,KAAK,CAAC;gBAC5B,QAAQ;gBACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,iCAAiC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC1C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC1C,CAAC,CAAC,SAAS,CACd;iBACA,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAsB,EACtB,KAAyB,EACzB,KAAgB,EAChB,IAAe,EAAE;IAEjB,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAwC,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM;YAAE,SAAS;QAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAyB,EACzB,KAAsB,EACtB,KAAgB,EAChB,IAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,iBAAiB,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACpB,GAAG,IAAI;YACP,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC,aAAa;YACxD,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ;SAC1C,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAChC,MAAyB,EACzB,QAAqC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAElD,MAAM,KAAK,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC3E,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1C,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/env-store.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The one place a secret lives across machines: SSM Parameter Store, one
+ * SecureString per name under the app's path (`/myapp/config/NAME`). KMS
+ * at rest, IAM at the door, every read in CloudTrail. Values never enter
+ * argv, logs or errors.
+ */
+import { type SSMClient } from "@aws-sdk/client-ssm";
+export declare const ENV_KEY: RegExp;
+export interface EnvEntry {
+    name: string;
+    value: string;
+}
+/** What the store knows about an entry besides its value. */
+export interface EnvListing {
+    name: string;
+    /** When the value last changed. */
+    updatedAt: string | null;
+    /** When the value stops working (a token's expiry), if whoever stored it knew. */
+    expiresAt: string | null;
+}
+export interface PutOptions {
+    /** ISO time the value stops working; absent = it does not, or nobody knows. */
+    expiresAt?: string | undefined;
+}
+export interface EnvStore {
+    /** Names, change and expiry times; never values. */
+    list(): Promise<EnvListing[]>;
+    get(name: string): Promise<string | null>;
+    /** Every entry, decrypted: what a pull or a deploy reads. */
+    all(): Promise<EnvEntry[]>;
+    put(name: string, value: string, o?: PutOptions): Promise<void>;
+    remove(name: string): Promise<boolean>;
+}
+/**
+ * Entries that stop working within `withinMs` of `now` (already expired
+ * included), soonest first: what a watcher re-mints.
+ */
+export declare function expiring(entries: readonly EnvListing[], withinMs: number, now?: number): EnvListing[];
+/** SSM under `prefix`: `/prefix/NAME`. The client comes in so tests pass a fake. */
+export declare function ssmEnvStore(ssm: SSMClient, prefix: string): EnvStore;
+export declare function memoryEnvStore(initial?: Record<string, string>): EnvStore & {
+    values: Record<string, string>;
+};
+/**
+ * `KEY=VALUE` lines → entries. Comments, blanks and quotes as a shell would
+ * read them; a value naming a readable file whose content is JSON (a
+ * service account) is inlined so the store holds the secret, not a path.
+ */
+export declare function parseDotenv(text: string, readFile?: (path: string) => string | null): EnvEntry[];
+/** Entries → `KEY=VALUE` lines. A multi-line value cannot live in one line: `files` takes it and the line names the path. */
+export declare function toDotenv(entries: EnvEntry[], files?: (name: string, value: string) => string): string;
+/** Entries → `export KEY='…'` lines for `eval "$(…)"`; single quotes are the one thing escaped. */
+export declare function toExports(entries: EnvEntry[]): string;
+/** Upsert `entries` into an env file's text; other lines untouched. */
+export declare function upsertDotenv(text: string, entries: EnvEntry[]): string;

package/dist/env-store.js

@@ -0,0 +1,213 @@
+/**
+ * The one place a secret lives across machines: SSM Parameter Store, one
+ * SecureString per name under the app's path (`/myapp/config/NAME`). KMS
+ * at rest, IAM at the door, every read in CloudTrail. Values never enter
+ * argv, logs or errors.
+ */
+import { DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, GetParametersByPathCommand, ParameterNotFound, PutParameterCommand, } from "@aws-sdk/client-ssm";
+/** SSM throttles writes at a few a second; a push of thirty keys backs off and goes on rather than dying. */
+async function patient(call, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await call();
+        }
+        catch (err) {
+            const throttled = err instanceof Error &&
+                (err.name === "ThrottlingException" || /Rate exceeded/i.test(err.message));
+            if (!throttled || attempt >= 8)
+                throw err;
+            await sleep(200 * 2 ** attempt);
+        }
+    }
+}
+export const ENV_KEY = /^[A-Z][A-Z0-9_]*$/;
+/**
+ * Entries that stop working within `withinMs` of `now` (already expired
+ * included), soonest first: what a watcher re-mints.
+ */
+export function expiring(entries, withinMs, now = Date.now()) {
+    return entries
+        .filter((e) => e.expiresAt !== null && Date.parse(e.expiresAt) - now <= withinMs)
+        .sort((a, b) => (a.expiresAt ?? "").localeCompare(b.expiresAt ?? ""));
+}
+/** SSM keeps expiry in the parameter's description, which reads without decrypting. */
+const EXPIRES = "expires ";
+const describe = (o = {}) => o.expiresAt ? `${EXPIRES}${new Date(o.expiresAt).toISOString()}` : "no expiry";
+const expiryOf = (description) => description?.startsWith(EXPIRES) ? description.slice(EXPIRES.length) : null;
+/** SSM under `prefix`: `/prefix/NAME`. The client comes in so tests pass a fake. */
+export function ssmEnvStore(ssm, prefix) {
+    const path = (name) => {
+        if (!ENV_KEY.test(name))
+            throw new Error(`env store: bad name ${name}`);
+        return `${prefix}/${name}`;
+    };
+    const nameOf = (p) => p?.slice(prefix.length + 1) ?? "";
+    const byName = (rows) => rows.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+        async list() {
+            const out = [];
+            let next;
+            do {
+                const r = await patient(() => ssm.send(new DescribeParametersCommand({
+                    ParameterFilters: [{ Key: "Path", Option: "OneLevel", Values: [prefix] }],
+                    NextToken: next,
+                })));
+                for (const p of r.Parameters ?? [])
+                    out.push({
+                        name: nameOf(p.Name),
+                        updatedAt: p.LastModifiedDate?.toISOString() ?? null,
+                        expiresAt: expiryOf(p.Description),
+                    });
+                next = r.NextToken;
+            } while (next);
+            return byName(out);
+        },
+        async all() {
+            const out = [];
+            let next;
+            do {
+                const r = await patient(() => ssm.send(new GetParametersByPathCommand({
+                    Path: prefix,
+                    Recursive: false,
+                    WithDecryption: true,
+                    NextToken: next,
+                })));
+                for (const p of r.Parameters ?? [])
+                    out.push({ name: nameOf(p.Name), value: p.Value ?? "" });
+                next = r.NextToken;
+            } while (next);
+            return byName(out);
+        },
+        async get(name) {
+            try {
+                const r = await ssm.send(new GetParameterCommand({ Name: path(name), WithDecryption: true }));
+                return r.Parameter?.Value ?? null;
+            }
+            catch (err) {
+                if (err instanceof ParameterNotFound)
+                    return null;
+                throw err;
+            }
+        },
+        async put(name, value, o) {
+            if (!value)
+                throw new Error(`env store: ${name} is empty`);
+            await patient(() => ssm.send(new PutParameterCommand({
+                Name: path(name),
+                Value: value,
+                // Always said, so a re-mint without an expiry clears the old one.
+                Description: describe(o),
+                Type: "SecureString",
+                // Past 4 KB (a service-account JSON) SSM needs the advanced tier; this picks it only then.
+                Tier: "Intelligent-Tiering",
+                Overwrite: true,
+            })));
+        },
+        async remove(name) {
+            try {
+                await ssm.send(new DeleteParameterCommand({ Name: path(name) }));
+                return true;
+            }
+            catch (err) {
+                if (err instanceof ParameterNotFound)
+                    return false;
+                throw err;
+            }
+        },
+    };
+}
+export function memoryEnvStore(initial = {}) {
+    const values = { ...initial };
+    const expires = new Map();
+    return {
+        values,
+        list: async () => Object.keys(values)
+            .sort()
+            .map((name) => ({ name, updatedAt: null, expiresAt: expiryOf(expires.get(name)) })),
+        all: async () => Object.entries(values)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([name, value]) => ({ name, value })),
+        get: async (name) => values[name] ?? null,
+        async put(name, value, o) {
+            if (!ENV_KEY.test(name))
+                throw new Error(`env store: bad name ${name}`);
+            values[name] = value;
+            expires.set(name, describe(o));
+        },
+        async remove(name) {
+            const had = name in values;
+            delete values[name];
+            expires.delete(name);
+            return had;
+        },
+    };
+}
+/**
+ * `KEY=VALUE` lines → entries. Comments, blanks and quotes as a shell would
+ * read them; a value naming a readable file whose content is JSON (a
+ * service account) is inlined so the store holds the secret, not a path.
+ */
+export function parseDotenv(text, readFile) {
+    const out = [];
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#") || !line.includes("="))
+            continue;
+        const i = line.indexOf("=");
+        const name = line
+            .slice(0, i)
+            .trim()
+            .replace(/^export\s+/, "");
+        let value = line.slice(i + 1).trim();
+        const q = value[0];
+        if (q === '"' || q === "'") {
+            const end = value.indexOf(q, 1);
+            value = end > 0 ? value.slice(1, end) : value.slice(1);
+        }
+        else
+            value = value.replace(/\s+#.*$/, "");
+        if (!ENV_KEY.test(name) || !value)
+            continue;
+        if (readFile && !value.trimStart().startsWith("{") && /\.json$/.test(value)) {
+            const inlined = readFile(value);
+            if (inlined?.trimStart().startsWith("{"))
+                value = inlined;
+        }
+        out.push({ name, value });
+    }
+    return out;
+}
+/** Entries → `KEY=VALUE` lines. A multi-line value cannot live in one line: `files` takes it and the line names the path. */
+export function toDotenv(entries, files) {
+    return `${entries
+        .map(({ name, value }) => {
+        if (!/[\r\n]/.test(value))
+            return `${name}=${value}`;
+        if (!files)
+            throw new Error(`${name} spans lines; give it a file`);
+        return `${name}=${files(name, value)}`;
+    })
+        .join("\n")}\n`;
+}
+/** Entries → `export KEY='…'` lines for `eval "$(…)"`; single quotes are the one thing escaped. */
+export function toExports(entries) {
+    return `${entries
+        .map(({ name, value }) => `export ${name}='${value.replace(/'/g, `'\\''`)}'`)
+        .join("\n")}\n`;
+}
+/** Upsert `entries` into an env file's text; other lines untouched. */
+export function upsertDotenv(text, entries) {
+    const lines = text.split("\n");
+    if (lines.at(-1) === "")
+        lines.pop();
+    for (const { name, value } of entries) {
+        const line = `${name}=${value}`;
+        const i = lines.findIndex((l) => l.startsWith(`${name}=`));
+        if (i >= 0)
+            lines[i] = line;
+        else
+            lines.push(line);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=env-store.js.map

package/dist/env-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-store.js","sourceRoot":"","sources":["../src/env-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAE7B,6GAA6G;AAC7G,KAAK,UAAU,OAAO,CACpB,IAAsB,EACtB,QAAQ,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7D,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GACb,GAAG,YAAY,KAAK;gBACpB,CAAC,GAAG,CAAC,IAAI,KAAK,qBAAqB,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC1C,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,mBAAmB,CAAC;AA+B3C;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,OAA8B,EAC9B,QAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC;SAChF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAE,EAAE,EAAE,CACtC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;AACjF,MAAM,QAAQ,GAAG,CAAC,WAA+B,EAAiB,EAAE,CAClE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE9E,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,GAAc,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,CAA6B,IAAS,EAAE,EAAE,CACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,IAAwB,CAAC;YAC7B,GAAG,CAAC;gBACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,IAAI,CACN,IAAI,yBAAyB,CAAC;oBAC5B,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzE,SAAS,EAAE,IAAI;iBAChB,CAAC,CACH,CACF,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;wBACpB,SAAS,EAAE,CAAC,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,IAAI;wBACpD,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;qBACnC,CAAC,CAAC;gBACL,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;YACrB,CAAC,QAAQ,IAAI,EAAE;YACf,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAG;YACP,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,IAAI,IAAwB,CAAC;YAC7B,GAAG,CAAC;gBACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,IAAI,CACN,IAAI,0BAA0B,CAAC;oBAC7B,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,KAAK;oBAChB,cAAc,EAAE,IAAI;oBACpB,SAAS,EAAE,IAAI;iBAChB,CAAC,CACH,CACF,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC3D,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;YACrB,CAAC,QAAQ,IAAI,EAAE;YACf,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CACtB,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACpE,CAAC;gBACF,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB;oBAAE,OAAO,IAAI,CAAC;gBAClD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,WAAW,CAAC,CAAC;YAC3D,MAAM,OAAO,CAAC,GAAG,EAAE,CACjB,GAAG,CAAC,IAAI,CACN,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,KAAK;gBACZ,kEAAkE;gBAClE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACxB,IAAI,EAAE,cAAc;gBACpB,2FAA2F;gBAC3F,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,IAAI;aAChB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB;oBAAE,OAAO,KAAK,CAAC;gBACnD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkC,EAAE;IAGjE,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO;QACL,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE,CACf,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACvF,GAAG,EAAE,KAAK,IAAI,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI;QACzC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC;YAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA0C;IAClF,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACnE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI;aACd,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,IAAI,EAAE;aACN,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;;YAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,SAAS;QAC5C,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,KAAK,GAAG,OAAO,CAAC;QAC5D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,QAAQ,CACtB,OAAmB,EACnB,KAA+C;IAE/C,OAAO,GAAG,OAAO;SACd,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QACnE,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;IACzC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,OAAO,GAAG,OAAO;SACd,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;SAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAmB;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { fileAudit, memoryAudit, type SecretAudit, type SecretUse } from "./audit.js";
+export { type CanaryOptions, CanaryTripped, canaryCredential, canaryStore, isCanary, } from "./canary.js";
+export { type Chained, type ChainedFile, chainedFile, rowHash, type Verification, verifyChain, } from "./chain.js";
+export { aesGcmCipher, type Cipher, isSealed, type KeychainItem, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
+export { type Credential, type CredentialEnvStore, type CredentialInput, type CredentialStore, credentialEnv, credentialEnvName, credentialSchema, type EnvNaming, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, pullCredentials, pushCredentials, } from "./credentials.js";
+export { ENV_KEY, type EnvEntry, type EnvListing, type EnvStore, expiring, memoryEnvStore, type PutOptions, parseDotenv, ssmEnvStore, toDotenv, toExports, upsertDotenv, } from "./env-store.js";
+export { newPassword } from "./passwords.js";
+export { envSecrets, memorySecrets, type SecretSource, type TrackingSecrets, trackingSecrets, } from "./secrets.js";
+export { tailJson, tailLines } from "./tail.js";
+export { base32Decode, findTotpSecret, parseOtpauth, type TotpAlgorithm, type TotpOptions, type TotpParams, totp, totpRemainingMs, } from "./totp.js";

package/dist/index.js

@@ -0,0 +1,11 @@
+export { fileAudit, memoryAudit } from "./audit.js";
+export { CanaryTripped, canaryCredential, canaryStore, isCanary, } from "./canary.js";
+export { chainedFile, rowHash, verifyChain, } from "./chain.js";
+export { aesGcmCipher, isSealed, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
+export { credentialEnv, credentialEnvName, credentialSchema, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, pullCredentials, pushCredentials, } from "./credentials.js";
+export { ENV_KEY, expiring, memoryEnvStore, parseDotenv, ssmEnvStore, toDotenv, toExports, upsertDotenv, } from "./env-store.js";
+export { newPassword } from "./passwords.js";
+export { envSecrets, memorySecrets, trackingSecrets, } from "./secrets.js";
+export { tailJson, tailLines } from "./tail.js";
+export { base32Decode, findTotpSecret, parseOtpauth, totp, totpRemainingMs, } from "./totp.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,QAAQ,EACR,cAAc,EAEd,WAAW,EACX,WAAW,EACX,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}

package/dist/passwords.d.ts

@@ -0,0 +1,2 @@
+/** A password no site refuses: 24 chars, at least one of each class, no look-alikes (l/1/O/0). */
+export declare function newPassword(length?: number, pick?: (n: number) => number): string;

package/dist/passwords.js

@@ -0,0 +1,19 @@
+/** Passwords drawn here: nobody picks them, nobody sees them. */
+import { randomInt } from "node:crypto";
+const LOWER = "abcdefghijkmnopqrstuvwxyz";
+const UPPER = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+const DIGIT = "23456789";
+const SYMBOL = "!@#$%^&*-_=+";
+const ALL = LOWER + UPPER + DIGIT + SYMBOL;
+/** A password no site refuses: 24 chars, at least one of each class, no look-alikes (l/1/O/0). */
+export function newPassword(length = 24, pick = randomInt) {
+    const chars = [LOWER, UPPER, DIGIT, SYMBOL].map((set) => set[pick(set.length)] ?? "a");
+    while (chars.length < length)
+        chars.push(ALL[pick(ALL.length)] ?? "a");
+    for (let i = chars.length - 1; i > 0; i--) {
+        const j = pick(i + 1);
+        [chars[i], chars[j]] = [chars[j], chars[i]];
+    }
+    return chars.join("");
+}
+//# sourceMappingURL=passwords.js.map

package/dist/passwords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.js","sourceRoot":"","sources":["../src/passwords.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,MAAM,GAAG,cAAc,CAAC;AAC9B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3C,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,OAA8B,SAAS;IAC9E,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * One named value, asked for by key at the moment it is needed (a card
+ * number, an API key), never carried on a plan or in a log. Env is the
+ * default source; the shared store (env-store.ts) is another.
+ */
+export interface SecretSource {
+    get(key: string): Promise<string>;
+}
+/** A key in camelCase (`cardCvv`) → `SECRET_CARD_CVV` in the environment, under the app's prefix. */
+export declare function envSecrets(env?: NodeJS.ProcessEnv, prefix?: string): SecretSource;
+export declare function memorySecrets(values: Record<string, string>): SecretSource;
+/** A secret source that remembers what it handed out, so a caller can tell a secret's value from any other. */
+export interface TrackingSecrets extends SecretSource {
+    /** The key a value was handed out under, or null. */
+    keyOf(value: string): string | null;
+}
+export declare function trackingSecrets(source: SecretSource): TrackingSecrets;